I am trying to improve my Apache security configuration and I seem to fail when it comes to the cipher suite.

This is what I had and works (but is less secure):


This is what Mozilla suggests (https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.6&openssl=1.0.2k&hsts=yes&profile=intermediate):


The errors I am getting with the new suite are these:

[Thu Dec 20 15:44:09.323393 2018] [ssl:error] [pid 13801:tid 140532479100672] (70008)Partial results are valid but processing is incomplete: [client xx.xxx.xxx.xxx:39814] AH02015: could not read request body for SSL buffer, referer: https://www.<myhost>/my/path
[Thu Dec 20 15:44:09.323443 2018] [ssl:error] [pid 13801:tid 140532479100672] [client xx.xxx.xxx.xxx:39814] AH02257: could not buffer message body to allow SSL renegotiation to proceed, referer: https://www.<myhost>/my/path


[Thu Dec 20 15:43:42.555266 2018] [ssl:error] [pid 11877:tid 140629057148672] [client xx.xxx.xxx.xxx:50368] AH02261: Re-negotiation handshake failed, referer: https://www.<myhost>/my/path

I am browsing the page with a Chrome Version 71.0.3578.98 (Official Build) (64-bit). Since it's SSL I thought I'd post the client, although this should be connected to server config.

For completeness I might add that this is neither an upload - nor a download request. It's a request to open a web form with a questionaire.

Apache and OpenSSL are:

# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017
# rpm -q httpd

edit1: The setup is two webservers behind a load balancer. The load balancer is not controlled by me and I am unaware of its settings. If this could be interfering I'd love to hear about it.

  • "The load balancer is not controlled by me and I am unaware of its settings" - that is something you really need to know. If the loadbalancer does some form of TLS termination and/or is a reverse proxy then you may be limited in what you can achieve from Apache alone. – HBruijn Dec 20 '18 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.