0

I am running a server which has tomcat7 and apache2 on it. I issue the following command via another remote host:

openssl s_client -connect my_site:443 -ssl3

This returns:

CONNECTED(00000003)
139773982140064:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1462854225
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

I want to disable SSLv3 , how do i do it?

7
  • You need to do it in your web server config. Google "disable SSLv3 in apache" (or "nginx" if you're using that). May 10, 2016 at 4:38
  • SSLv3 seems to be already disabled. The TLS handshake fails: ...wrong version number...Cipher : 0000. May 10, 2016 at 4:40
  • @NeilSmithline i am running tomcat7 May 10, 2016 at 5:09
  • @SteffenUllrich: why is SSL-Session: Protocol : SSLv3 May 10, 2016 at 5:10
  • 2
    Because this is what the client tried to use. s_client is just a debugging tool so the output is not really user friendly. but the tell-tales in this case are the error message and that it did not get a common cipher (i.e. NONE or 0000). May 10, 2016 at 5:13

1 Answer 1

0

Add or update the following lines in your configuration:

SSLProtocol all -SSLv2 -SSLv3

Then run: sudo apache2ctl configtest && sudo service apache2 restart

1
  • Ravi - it sounds like the OP may be running Tomcat 7 as the web server as well. as the Servlet container. That's an atypical deployment strategy, but possible. That said, I'm really not certain based on the little information we have gotten from the OP. May 10, 2016 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .