0

I followed the instructions for CentOS 6 to disable SSL v3 in Apache (2.2.15, not sure how much that matters), but it appears to only disable it for incoming clients, not outgoing requests (such as to authorize.net for credit card transactions). I'm having a hard time finding any instructions other than what seems to be just disabling it for clients.

I edited /etc/httpd/conf.d/ssl.conf and modified this line:

SSLProtocol all -SSLv2 -SSLv3

I restarted Apache, but when I run an outgoing request, it appears SSLv3 is still possibly being used (I'm only showing what appears to be most relevant to this issue; you can try yourself to see the full output):

# openssl s_client -connect google.com:443

New, TLSv1/SSLv3, Cipher is blah blah blah

SSL-Session:
Protocol  : TLSv1.2
Cipher    : blah blah blah
more blah blah blah

Start Time: 1414621669
Timeout   : 300 (sec)
Verify return code: 0 (ok)

Am I reading this wrong or is there something else I need to do to prevent the server from falling back to SSLv3 at all when sending requests?

Improve this question
5
  • 5
    You do realize that Apache is simply a web server and not some magic box that manages every web transaction on your system right? openssl is not Apache. Apache doesn't make outgoing requests under normal circumstances (ProxyPass directives or authentication modules aside)
    – user143703
    Oct 29, 2014 at 22:40
  • Looks like TLS 1.2 to me.
    – Michael Hampton
    Oct 29, 2014 at 23:30
  • TLSv1/SSLv3 just refers to protocol used inside the initial handshake, the final protocol version is shown as TLSv1.2.
    – Steffen Ullrich
    Oct 30, 2014 at 2:25
  • Apache uses OpenSSL to handle SSL on our server (default CentOS 6.5 settings). Every document I've read said to go to /etc/httpd/conf.d/ssl.conf. httpd is Apache. I don't know how it all does what, all I know is the SSL conf file is in httpd, and it uses OpenSSL. So yes, I kind of assumed disabling it in the recommended conf file magically disabled it all the way around for anything applicable.
    – Davicus
    Oct 30, 2014 at 20:20
  • The final protocol may be TLSv1.2, but because SSLv3 is still listed there it means that it could fallback to SSLv3. I haven't read documentation on how to absolutely prevent that from happening with either Apache or OpenSSL (and keep in mind that the ssl.conf file is under the Apache httpd folder, and it uses the CentOS default OpenSSL for it).
    – Davicus
    Oct 30, 2014 at 20:21

1 Answer 1

Reset to default
1

Figure out what makes the outbound SSL requests. Is it some PHP code? Or some Java code? Or some Python code? Whatever that is you'll have to configure the SSL/TLS options in the appropriate place for your code. Almost certainly it's not Apache you need to configure here.

Also be aware of the SSL downgrade attack that may be used to force downgrading a TLS connection down to SSLv3 to enable the Poodle attack. You'll have to update OpenSSL to disable this downgrade attack.

Improve this answer
1
  • I guess maybe I need to look up configuration for disabling it completely in OpenSSL's conf file (if it's the /etc/httpd/conf.d/ssl.conf file, I'll be confused, because I thought I already fixed that).
    – Davicus
    Oct 30, 2014 at 20:22

Not the answer you're looking for? Browse other questions tagged .