0

I am trying to improve my Apache security configuration and I seem to fail when it comes to the cipher suite.

This is what I had and works (but is less secure):

SSLCipherSuite "EECDH+ECDSA+AESGCM:EECDH+ECDSA:EECDH:EDH+AESGCM:EDH:+3DES:ECDH+AESGCM:ECDH+AES:ECDH:AES:HIGH:MEDIUM:!RC4:!CAMELLIA:!SEED:!aNULL:!MD5:!eNULL:!LOW:!EXP:!DSS:!PSK:!SRP"

This is what Mozilla suggests (https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.6&openssl=1.0.2k&hsts=yes&profile=intermediate):

SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

The errors I am getting with the new suite are these:

[Thu Dec 20 15:44:09.323393 2018] [ssl:error] [pid 13801:tid 140532479100672] (70008)Partial results are valid but processing is incomplete: [client xx.xxx.xxx.xxx:39814] AH02015: could not read request body for SSL buffer, referer: https://www.<myhost>/my/path
[Thu Dec 20 15:44:09.323443 2018] [ssl:error] [pid 13801:tid 140532479100672] [client xx.xxx.xxx.xxx:39814] AH02257: could not buffer message body to allow SSL renegotiation to proceed, referer: https://www.<myhost>/my/path

and

[Thu Dec 20 15:43:42.555266 2018] [ssl:error] [pid 11877:tid 140629057148672] [client xx.xxx.xxx.xxx:50368] AH02261: Re-negotiation handshake failed, referer: https://www.<myhost>/my/path

I am browsing the page with a Chrome Version 71.0.3578.98 (Official Build) (64-bit). Since it's SSL I thought I'd post the client, although this should be connected to server config.

For completeness I might add that this is neither an upload - nor a download request. It's a request to open a web form with a questionaire.

Apache and OpenSSL are:

# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017
# rpm -q httpd
httpd-2.4.6-80.el7.centos.1.x86_64

edit1: The setup is two webservers behind a load balancer. The load balancer is not controlled by me and I am unaware of its settings. If this could be interfering I'd love to hear about it.

  • "The load balancer is not controlled by me and I am unaware of its settings" - that is something you really need to know. If the loadbalancer does some form of TLS termination and/or is a reverse proxy then you may be limited in what you can achieve from Apache alone. – HBruijn Dec 20 '18 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.