I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by disabling SSL Compression, which was added to Apache 2.2.22 (See Bug 53219).

I am running Scientific Linux 6.3, which ships with httpd-2.2.15. Security fixes for upstream versions of httpd 2.2 should be backported to this version.

# rpm -q httpd

# httpd -V
Server version: Apache/2.2.15 (Unix)
Server built:   Feb 14 2012 09:47:14
Server's Module Magic Number: 20051115:24
Server loaded:  APR 1.3.9, APR-Util 1.3.9
Compiled using: APR 1.3.9, APR-Util 1.3.9

I tried SSLCompression off in my configuration, but that results in the following error message:

# /etc/init.d/httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd: Syntax error on line 147 of /etc/httpd/httpd.conf:
Invalid command 'SSLCompression', perhaps misspelled or defined by a module not included in the server configuration

Is it possible to disable SSLCompression with this version of Apache Webserver?

1 Answer 1


On March 4, 2013, Red Hat provided updated OpenSSL packages which address this issue. You can receive them through your normal update channels.

The original answer was:

Red Hat has not provided an updated package which provides this functionality, though there is a workaround available. Edit the /etc/sysconfig/httpd file and add this line to it:


Then restart Apache:

service httpd restart

This will cause OpenSSL, which provides crypto functions for Apache, to not offer compression.

  • 1
    What about mod_deflate? Shouldn't that be disabled as well?
    – sjbotha
    Mar 7, 2013 at 20:06
  • 1
    No, that's irrelevant. Mar 7, 2013 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.