2

First off I'm not an Apache web server admin, I support an application which a customer is trying to connect to via Apache as a reverse proxy and load balancer.

The customer has two versions of our application running on two different servers. Both severs are identical in terms of version and updates.

One version of the software has been patched for the POODLE vulnerability and disables all SSLv2 and SSLv3 incoming connections, while the other version allows these connections.

The customer states that they have SSLProtocol ALL -SSLv2 -SSLv3 in their Apache config, however they can connect to the old version of the application which only supports SSLv2 and SSLv3, but cannot connect to the latest version as Apache returns a 404 error.

Given that the customer has set the SSLProtocol ALL -SSLv2 -SSLv3 attributes can anyone please confirm if these attributes only disable these protocols for incoming connections and Apache would still use these protocols for outgoing connections?

1

My instinctive reaction is that the server settings such as SSLProtocol are what Apache allows clients to negotiate, but what Apache and web applications will use when they are the client, i.e. when connecting to another server; that depends on specific client settings for the library that is used, or the method, or the framework used by the web application.

For instance the SSlProxyCyperSuite directive use for Apache's (reverse) proxy functionality or a specific PHP context: SSL context options

  • Thanks, I'll take a look at this. In terms of our application is waits for a HTTPS connection via Apache, but if a SSLv2 or SSLv3 connection is attempted we simply close the connection, but our logs do not show a connection attempt being made – Ringo May 25 '15 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.