0

Tried to enable TLS 1.2 in /conf/extra/httpd-ssl.conf in Apache 2.4.10 as below combinations.

SSLProtocol -all +TLSv1.2

After restarting httpd service, getting error 'illegal Protocol TLSv1.2' as below. AH00526: Syntax error on line 260 of /opt/NSAx/apache2.4-npservers/conf/extra/httpd-ssl.conf: SSLProtocol: Illegal protocol 'TLSv1.2'

Then updated SSLProtocol in http-ssl.conf file. SSLProtocol -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2

After restarting httpd service, getting error 'illegal Protocol TLSv1.1' as below. AH00526: Syntax error on line 260 of /opt/NSAx/apache2.4-npservers/conf/extra/httpd-ssl.conf: SSLProtocol: Illegal protocol 'TLSv1.1'

Set this SSLHonorCipherOrder in httpd-ssl.conf file both on / off. still same error. SSLHonorCipherOrder off

Also tried different set of SSLCipersuite from [https://ssl-config.mozilla.org/#server=apache&version=2.4.10&config=intermediate&openssl=1.0.2k-fips&guideline=5.6][1]

ran command 'nmap --script ssl-enum-ciphers -p 443 hostname' in linux and returned SSLv3, TLSv1.0 enabled.

Hope, mentioned version of OpenSSL, Apache & Linux OS will support TLS 1.2. Please help me, why does this configuration cause 'illegal protocol' error and How can I enable TLS 1.2 only with this setup?

Really Appreciate, if any help.

6
  • Where did you get this strange build of Apache? Aug 27, 2020 at 16:39
  • When I ran httpd -v command in linux, got Server version: Apache/2.4.10 (Unix) & Server built: Apr 13 2016 03:34:11.
    – Lakshmi M
    Aug 27, 2020 at 18:22
  • Yes, but where did it come from? Aug 27, 2020 at 18:47
  • Thanks for response! They installed apache 2.4.10 version long back it seems. I just got a chance to work on TLS protocol validation alone. Could you please recommend configurations?
    – Lakshmi M
    Aug 27, 2020 at 19:09
  • Apache uses openssl, so whatever your openssl libraries support, will be supported by Apache. I'd recommend getting a newer version or compile yourself with modern openssl libs. Aug 28, 2020 at 22:27

0

You must log in to answer this question.

Browse other questions tagged .