1

I purchased the GeoTrust QuickSSL Premium certificate from ssls.com and installed it on my web server which is running Linux Apache on CentOS 6.5.

Google Chrome on Windows 7 said

"The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and ECDHE_RSA as the key exchange mechanism."

The screen shot is as follows.

enter image description here

The certificate path is as follows.

enter image description here

The first part of the certificate details is as follows.

enter image description here

I went to https://knowledge.geotrust.com/support/knowledge-base and it said "Certificate is installed correctly".

I tested my site on www.ssllabs.com/ssltest/analyze.html. It rated my site with an A and said that my signature algorithm is SHA256withRSA. I went to shaaaaaaaaaaaaa.com said

Nice. example.com has a verifiable certificate chain signed with SHA-2.

I went to whynopadlock.com and everything checked out positively.

I set up the intermediate certificate as per the instructions given by GeoTrust.

I went to my web server and added the following to /etc/httpd/conf.d/ssl.conf

<VirtualHost _default_:443>

\# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www"
ServerName www.clusterprism.com:443

\# Added to try to fix Google Chrome's "SHA1 for message authentication" nonsense
SSLEngine on
SSLCertificateFile /etc/httpd/RapidSsl/public.crt
SSLCertificateChainFile /etc/httpd/RapidSsl/intermediateNewName.crt
SSLCertificateKeyFile /etc/httpd/RapidSsl/private.key
SSLCACertificateFile /etc/httpd/RapidSsl/ca-bundle.crt

# intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          !RC4:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder     on

It made no difference

1 Answer 1

3

"The connection ...with SHA1 for message authentication

It is using SHA-1 for message authentication (HMAC), not for certificate signature. Both are unrelated. HMAC is used for the integrity of the messages and the security considerations are different there from the certificate signatures, so it is perfectly fine to use SHA-1 in this case.

4
  • So is the message about SHA-1 just informational rather than a warning? Thanks, Jun 20, 2015 at 10:46
  • 1
    Yes, SHA-1 is fine in the cipher. The "obsolete" message refers to other parts of the cipher, see stackoverflow.com/questions/30270788/… Jun 20, 2015 at 11:17
  • Thank you so much! The solution is given by Anand Bhat at the link you provided. I wish I could give you more up votes. Jun 20, 2015 at 15:00
  • I added one, @SteffenUllrich thank you for giving us a friendly spin towards the right direction! Mar 3, 2016 at 5:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .