1

I am trying to fully support forward secrecy on my FreeBSD Apache 2.4.16 server. I am using the correct cipher suite as the same cipher order works correctly on a different FreeBSD server. However, when I attempt to SSL test the server, the ECDHE cipher suites do not appear, even though running openssl ciphers shows that they exist.

What could be the cause for this?

The configured ciphers are these:

SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

Improve this question
7
  • What's your ciphers config string? – StackzOfZtuff Mar 15 '16 at 5:42
  • @StackzOfZtuff updated original post with cipher suite – ashin999 Mar 15 '16 at 6:06
  • What kind of certificate did you install? RSA or ECDSA? – StackzOfZtuff Mar 15 '16 at 7:13
  • @StackzOfZtuff RSA. Would that be the cause? – ashin999 Mar 15 '16 at 7:36
  • @StackzOfZtuff I just confirmed that it is an issue with Apache or Openssl, and not virtualhost specific. I installed a different certificate on a different subdomain, and the issue persists. – ashin999 Mar 15 '16 at 8:00
1

The root of the issue seems to occur with the mod_security2 2.9.0 module that I was using. It doesn't like ECDHE so it doesn't allow it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.