We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever.

SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on

However, I'm still failing the SslLabs scan with the following message:

This server supports anonymous (insecure) suites

Why is it still failing if I'm only using strong ciphers and can't find any overriding configuration anywhere?

  • That CDH is supposed to be ECDH, I guess? Other than that, I'm guessing, that there's a mismatch between global and vHost config here. But you'd have to show the whole config to check that. – StackzOfZtuff Dec 25 '15 at 12:21
  • It's the end of the road for running secure web sites on RHEL 5. Even if you somehow get this working today, you will not be able to enable TLS 1.2 as mandated in the PCI specifications to be done before 30th June. Plan now to upgrade to the most recent version of RHEL. – Michael Hampton Dec 29 '15 at 14:24

openssl ciphers -v with the cipher string will show the list.

You don't disable null encryption with !eNULL. OpenSSL does not enable it even in ALL but might as well make turning it off explicit.

Check for any config files containing SSL. And confirm it is httpd listening on that port.

You can get a second opinion with a local SSL/TLS scan script. There are a couple good ones that show exactly which ciphers they use.

Strong ciphers is relative. OpenSSL 0.9.8 can't really do TLS 1.1 or 1.2 so it isn't going to provide modern security (or score well in SSLLabs).

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.