1

I want to change the configuration of my Apache2 server so that it accepts the following lines in order to disable weak TLS ciphers and enable perfect forward secrecy.

SSLProtocol all -SSLv2 -SSLv3
SSLCompression Off
SSLHonorCipherOrder on 
SSLCipherSuite "EECDH+AESGCM EDH+AESGCM EECDH -RC4 EDH -CAMELLIA -SEED !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

However, I am being a bit confused. Plesk 11.5 was preinstalled on the server and is used to manage the Apache2 webserver. I changed the lines in

/etc/apache2/mods-enabled/ssl.conf

and restartet apache by typing

service apache2 restart

However, sslscan returns the following:

phil@phil-desktop:~$ sslscan www.phkr.de | grep Accepted
Accepted  SSLv3  256 bits  DHE-RSA-AES256-SHA
Accepted  SSLv3  256 bits  DHE-RSA-CAMELLIA256-SHA
Accepted  SSLv3  256 bits  AES256-SHA
Accepted  SSLv3  256 bits  CAMELLIA256-SHA
Accepted  SSLv3  168 bits  EDH-RSA-DES-CBC3-SHA
Accepted  SSLv3  168 bits  DES-CBC3-SHA
Accepted  SSLv3  128 bits  DHE-RSA-AES128-SHA
Accepted  SSLv3  128 bits  DHE-RSA-SEED-SHA
Accepted  SSLv3  128 bits  DHE-RSA-CAMELLIA128-SHA
Accepted  SSLv3  128 bits  AES128-SHA
Accepted  SSLv3  128 bits  SEED-SHA
Accepted  SSLv3  128 bits  CAMELLIA128-SHA
Accepted  SSLv3  128 bits  RC4-SHA
Accepted  SSLv3  128 bits  RC4-MD5
Accepted  TLSv1  256 bits  DHE-RSA-AES256-SHA
Accepted  TLSv1  256 bits  DHE-RSA-CAMELLIA256-SHA
Accepted  TLSv1  256 bits  AES256-SHA
Accepted  TLSv1  256 bits  CAMELLIA256-SHA
Accepted  TLSv1  168 bits  EDH-RSA-DES-CBC3-SHA
Accepted  TLSv1  168 bits  DES-CBC3-SHA
Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA
Accepted  TLSv1  128 bits  DHE-RSA-SEED-SHA
Accepted  TLSv1  128 bits  DHE-RSA-CAMELLIA128-SHA
Accepted  TLSv1  128 bits  AES128-SHA
Accepted  TLSv1  128 bits  SEED-SHA
Accepted  TLSv1  128 bits  CAMELLIA128-SHA
Accepted  TLSv1  128 bits  RC4-SHA
Accepted  TLSv1  128 bits  RC4-MD5

So I assume that I have to change the configuration elsewhere?

Any help appreciated, thanks!

1 Answer 1

1

I finally figured it out. Creating the file

/etc/apache2/conf.d/zz050-psa-disable-weak-ssl-ciphers.conf

and adding the lines to it did the trick.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .