1

I have a kvm server, Centos 6.6 host with 6.6 guests. We run a php based web app that uses LDAP authentication for our clients. We just moved a client to this setup and they are reporting that all ldap traffic is being sent with TLS v1.1 not TLS v1.2 as it previously was. I've verified the versions of OpenSSL and OpenLDAP are the same between the old setup and the new one. I've dug around everywhere and get seem to find the reason why. The vms are all on private ips and share the public ip through NAT rules and Nginx upstream directives.

Anyone have an idea why the traffic would suddenly be v1.1?

The linked OpenSSL versions:

  • host: libssl.so.10 => /usr/lib64/libssl.so.10
  • guest: libssl.so.10 => /usr/lib64/libssl.so.10
  • Nginx: built with OpenSSL 1.0.1e-fips
  • ldd $(which nginx) | grep ssl will tell you what OpenSSL libraries nginx is using from your system. nginx -V would tell you if it was compiled with statically linked OpenSSL libraries. – Hyppy Jun 1 '15 at 19:38
  • host: libssl.so.10 => /usr/lib64/libssl.so.10 guest: libssl.so.10 => /usr/lib64/libssl.so.10 Nginx: built with OpenSSL 1.0.1e-fips – Minelr G Jun 1 '15 at 19:48
2

The answer in our case was to force php to use tls v1.2 in the php.ini file:

crypto_method = STREAM_CRYPTO_METHOD_TLSv1_2_SERVER

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.