2

I'm trying to disable RC4 ciphers by using this configuration on apache:

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

But Qualys SSLTest is still saying that I'm using RC4, even though there is this !RC4 flag.

I've tried this too:

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

I'm using Apache 2.4 and OpenSSL 1.0.1j

Thanks

2

Try this:

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 !EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

Changes:

  1. EECDH+aRSA+RC4 become !EECDH+aRSA+RC4
  2. Remove RC4

Restart web server, clear cache in Qualys SSLTest.

| improve this answer | |
  • 2
    This one worked, but there was another thing wrong, my virtual host configuration was overwriting apache configuration, I feel so stupid, thanks! – Rogerio Chaves Feb 14 '15 at 0:19
3

Well, the first one includes RC4 as well as !RC4. It should contain !RC4 only. The second one doesn't explicitly disable RC4 via a !RC4 parameter. Don't forget to restart apache after the configuration changes.

| improve this answer | |
  • Yeah, I've tried with the !RC4 at the end of the second one and it didn't work either. Restarting apache and clearing the qualys ssl test cache. – Rogerio Chaves Feb 13 '15 at 0:22
  • 1
    The definition of !RC4 is to 'disable even when enabled elsewhere'. You are thinking of -RC4 which would mean it could be overruled somewhere else. The !RC4 should be enough therefore. – Jeff Feb 13 '15 at 10:05
1

Removing all RC4 references should be enough, so if you did that already, you should check if you're hitting the right virtual host.

| improve this answer | |
  • 1
    Oh man, my virtual host configuration was overwriting my apache configuration, I feel so stupid – Rogerio Chaves Feb 14 '15 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.