From PCI scan results:

Synops is : The remote service encrypts traffic using a protocol with known weaknesses .

Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients .

See also : http://www.schneier.com/paper-ssl.pdf

Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead.

Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

I have tried to change

SSLProtocol all -SSLv2 to SSLProtocol -ALL +SSLv3 +TLSv1


But using SSLdigger, it shows the same result. Is this the right way to do something like this?


3 Answers 3


For Apache these lines should be sufficient:

SSLProtocol -SSLv2 +SSLv3 +TLSv1

You can add MEDIUM if you want, MEDIUM is 128-bit in Apache, but most browsers support high, so it's usually unnecessary. Note that most other resources use the term "medium" for 56/65/96-bit encryption, so be careful to compare bit levels, not names.

The e-mail stuff we'd have to know what software you're running. 465 is SMTP over SSL. 993 is IMAP over SSL. 995 is POP3 over SSL.


See https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf. Specifically for this, page 35. You're not actually required in any way to modify your SSL settings for PCI compliance if they're not insecure -- which is different than "weaker, but backwards compatible." That said, it seems you're trying to configure your SSL settings in one place, but you need to alter it for each daemon. Depending on your systems configuration, offloading your SSL to an endpoint may make management of this easier.


I ran into the same issue a few weeks ago. I found the solution in this article:

SSL cipher settings - For the good of all of us

The configs for various programs are at the end of the text, but the article is
a damn good read on this topic. So take a few minutes and read it completely.

Best regards, Phil.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.