At application level there is sometimes no (easy) way to, say, disable SSLv2 etc. What about at openssl level (of course for applications that use the openssl shared libs) ?


Generally speaking, it is possible to compile OpenSSL without SSLv2 support, but then you may have to re-compile most (if not all) of the application relying on it. I believe the Ubuntu guys do something similar. If you think going this way, it may be simpler to just patch your application to use SSLv3 or TLSv1.

According to this blog post your other options are application-specific configuration (if your application supports it), or the use of stunnel.

Other than that, I'm not aware of any other option to disable specific SSL versions or algorithms.


I do it with apache config: In my VirtualHost thise code enables only SSL3 but disable everything else f.e. TLS and SSL2.

   SSLEngine on
   SSLProtocol -all +SSLv3
   SSLCertificateFile /usr/local/etc/apache22/ssl/my.pem
   SSLCertificateKeyFile /usr/local/etc/apache22/ssl/my.key 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.