I ran in some trouble today after spinning up a new server. I did the following:
- Installed CentOS 7
- Installed Apache + PHP
- Securing my server with SSL (letsencrypt)
But when I checked my configuration with an SSL-Test (ssllabs.com) I got a grade C. It was because I still had SSLv3 enabled. Wired. I had disabled it in the letsencrypt configuration file.
But after some time I found out, that there is another ssl-config file. SSLv3 was not disabled there by default and Apache loaded this value.
My problem is I got 2 files:
/etc/letsencrypt/options-ssl-apache.conf: Let's Encrypt configuration file, which is included in every virtual host definition.
/etc/httpd/conf.d/ssl.conf: The "standard" SSL configuration file.
After disabling SSLv3 in the "standard" config I got an A+ rating. It seems that Apache grabbed the "SSLProtocol" definition from the second file, but all other options from the first file.
How can I determine, which values Apache is loading and from which file?