Disable SSL2 for each domain using vhosts_ssl.conf

Question

Server using Apache and Plesk 9.

I have set-up multiple domains each with its own IP for SSL. Each domain has its own SSL config file /var/www/vhosts/mydomain/conf/vhost_ssl.conf

I have disabled SSLv2 in /etc/httpd/conf.d/ssl.conf and checked it with

openssl s_client –ssl2 –connect localhost:443 result is an error.. which is correct

However when i test the domain to see if SSLv2 is disabled

openssl s_client –ssl2 –connect mydomain:443 result is domain has SSLv2 support - not what i want

My question is... Do i have to add lines to /var/www/vhosts/mydomain/conf/vhost_ssl.conf to disable SSLv2 support for that domain...?

Is yes, do i need to copy the full <VirtualHost _default_:443>....</VirtualHost> section form /etc/httpd/conf.d/ssl.conf and add it to /var/www/vhosts/mydomain/conf/vhost_ssl.conf ?

Answer 1

I'm afraid so, the attribute change in the default vhost won't transfer to the rest of the VirtualHost.

However since you want the same SSL config for all of them what I would do if I were you is to keep the SSL settings in a separate file and then Include the file inside each vhost.

<VirtualHost xxx:443>
   ServerName yyy
   Include ssl_paramters.conf
</VirtualHost>

Answer 2

Add the following to your global configuration.

# enable only secure protocols: SSLv3 and TLSv1, but not SSLv2
SSLProtocol all -SSLv2

You may also want this.

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list.
#   enable only secure ciphers:
SSLCipherSuite HIGH:MEDIUM:!ADH
#   Use this instead if you want to allow cipher upgrades via SGC facility.
#   In this case you also have to use something like
#        SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
#   see http://httpd.apache.org/docs/2.2/ssl/ssl_howto.html.en#upgradeenc
#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL