We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever.
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite CDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
However, I'm still failing the SslLabs scan with the following message:
This server supports anonymous (insecure) suites
Why is it still failing if I'm only using strong ciphers and can't find any overriding configuration anywhere?
CDH
is supposed to beECDH
, I guess? Other than that, I'm guessing, that there's a mismatch between global and vHost config here. But you'd have to show the whole config to check that.