21

Does anyone know why i can't disable tls 1.0 and tls1.1 by updating the config to this.

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 

After doing this, i reload apache I do an ssl scan using ssllabs or comodo ssl tool, and it still says tls 1.1 and 1.0 are supported. I would like to remove these?

35

When you have multiple TLS VirtualHosts and use Server Name Indication (SNI) it is an allowed syntax to have a SSLProtocol directive for each VirtualHost, but unless you have IP VirtualHosts in practice the settings from the first occurrence of the SSLProtocol directive are used for the whole server and/or all name-based VirtualHosts supporting TLS1.

So check your main httpd.conf (and all included snippets from for instance conf.d/*.conf and similar includes) for more occurrences of the SSLProtocol directive.

You syntax is correct, although I agree with ezra-s' answer that, when you expand the all shorthand, you can slightly improve upon:

 SSLProtocol +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 

by simply using:

 SSLProtocol TLSv1.2
  • This all makes sense however I did what you recommended. I grep'd my /etc/httpd directory for all references of "SSLProtocol" . I then updated it to SSLProtocol TLSv1.2, then did a restart and it still shows that tls 1.0 and 1.1 is supported. I also tried it on another one of my servers and same issue. Any ideas? – David May 4 '17 at 23:09
  • False alarm, this was indeed cached by comodo and ssllabs reports. It seems to be reporting correctly now. Thank you. – David May 4 '17 at 23:25
  • 1
    I think I would recommend using "all" with minus for the protocols you don't want. Future versions of apache define "all" differently as new standards are developed and old standards are found to be insecure. – bobpaul Oct 20 '17 at 21:56
7

that you have specified is enough, it shouldn't show any other protocols. Remember SSLLABS caches recent tests. Although knowing that there are no other protocols defining it like you did is kind of convoluted on purpose.

In any case you can use that or simply:

SSLProtocol TLSv1.2
  • Is there any difference if you specify -ALL +TLSv1.2? – Chazy Chaz Sep 5 '17 at 10:43
  • "All" expands to "+SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2". I don't see a benefit to using "-All". Actually, from the documentation it's not clear that "-all" is even valid syntax. You can do [+/-]protocol but all isn't a protocol: httpd.apache.org/docs/2.4/mod/mod_ssl.html – bobpaul Oct 20 '17 at 21:35
1

Disable TLS1.0 version in Apache.

If you have multiple virtual hosting then you have to update all configurations file, otherwise,ssl.conf is enough.

To check TSL supporting version:

# nmap --script ssl-enum-ciphers -p 443 192.168.11.10 | grep TLSv
|   TLSv1.0:
|   TLSv1.1:
|   TLSv1.2:

Modify the Apache configuration file vi /etc/httpd/conf.d/web.conf remove all TLS and allow only TLS1.2.

SSLProtocol TLSv1.2

Validate after the modification.

# grep SSLProtocol /etc/httpd/conf.d/web.conf
SSLProtocol TLSv1.2

# nmap --script ssl-enum-ciphers -p 443 192.168.11.10 | grep TLSv
|   TLSv1.2:
# service httpd restart
  • +1 for pointing me at the nmap scripts-- a very handy way to grab just what I want without too much unnecessary information. – Stefan Lasiewski Feb 15 at 0:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.