I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off. I tried to search google, but didnt find any helpful. Can anybody tell me how to set it off in Apache 2.2.16 without upgrading the version.
Sometimes, even with the latest version of Apache, if the current openssl library is not enough recent, the server returns the following error:
Invalid command 'SSLCompression', perhaps misspelled or defined by a module not included in the server configuration.
In this case you can disable the compression exporting the following variable before start Apache httpd server:
I have found the suggestion here:
You'll have to upgrade to at least version 2.2.24 to be able to do this.
From version 2.2.24 and up you can disallow SSL compression on the server level or for individual vhosts with the following directive:
So for a single vhost you can disallow it like this:
<VirtualHost *:443> ServerName "my.example.com" DocumentRoot "/var/www/html" SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP SSLCompression off # disallow for this vhost SSLCertificateFile /etc/ssl/my.example.com.crt SSLCertificateKeyFile /etc/ssl/my.example.com.key </VirtualHost>
I don't have enough points to upvote or comment on other replies, so I'll chime in here. As Mathias states, you need at least 2.2.24 to disable compression.
Just be aware, it DOES NOT work inside a virtualhost directive in 2.2.25, as my server just spat out:
This version of openssl does not support configuring compression within <VirtualHost> sections.
However, it works perfectly fine in the main httpd.conf file for server-wide effect.