3

I haven't been able to find a solution for this, if there is please do refer to it.

Running:

  • Windows7 x64
  • Apache 2.4.4
  • OpenSSL 1.0.1j

and have the following in my httpd_ssl

SSLStrictSNIVHostCheck off  
SSLProtocol All -SSLv2 -SSLV3  
SSLCompression off  
SSLInsecureRenegotiation off  
SSLHonorCipherOrder on  

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL 
!LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

SSLUseStapling on  
SSLStaplingResponderTimeout 5  
SSLStaplingReturnResponderErrors off  

Question:

What ever I do, I can't seem to enable TLSv1.1 & TLSv1.2.
Ran a ServerSSLTest script and all I get is Supported versions: TLSv1.0

What am I missing?

3 Answers 3

5

Firstly, you need to you have TLSv1.1 & V1.2 support in OpenSSL - with your v1.0.1j, you do.

Next, is Apache V2.2.24 (or later) support for configuration items relating to SSL. In particular, to specify anything later than TLS1 (i.e. TLSv1.1 TLSv1.2) you need that later version. You have 2.4.4, so that should be okay.

Next, there is an "interaction" between the Apache configuration parameters: SSLProtocol and SSLCipherSuite.

So for your desired configuration, TLSv1.1 & TLSv1.2, you'd need something like:

SSLProtocol=All -SSLv2 -SSLV3 -TLSv1
SSLCipherSuite HIGH:!aNULL:!MD5:!RC4

I appreciate you have a more specific cipher suite list:

EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4

However, when I checked with my openssl (v1.0.1 stream) I found the following pre-TLSv1.2 suites were supported:

 openssl ciphers -s -v 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4'

ECDHE-RSA-AES256-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1
ECDHE-ECDSA-AES256-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1
ECDHE-RSA-AES128-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
ECDHE-ECDSA-AES128-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA1
DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-SEED-SHA        SSLv3 Kx=DH       Au=RSA  Enc=SEED(128) Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1

Then checking here (section A.5), https://www.rfc-editor.org/rfc/rfc4346 I don't think any of the supported suites listed by my openssl are actually TLSv1.1 valid, so you'd only end up with TLSv1.2, when tested (say at Qualys https://www.ssllabs.com/ssltest/).

Lastly, there's the whole issue of client support - the Qualys link above is handy as it lists which type of client (down to specific Android versions, for example) would be able to connect to the submitted test server). As you are quite cipher specific, I think you're not going to risk too much by allowing TLSv1 (for which read v1.0) as well as V1.1 & V1.2, unless you know you visitor base will not include TLSv1 only capable clients.

1
  • Hello, Thank you for your answer. Nothing worked until yesterday when I got me a new ssd and clean installed my win10 on it :D
    – deltaRoot
    Aug 21, 2015 at 8:46
1

To generate an automatic ssl-config file automatically, Mozilla has a ssl-config generator:

https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.0&openssl=1.0.1e&hsts=yes&profile=modern

This will give a template for an Apache 2.4 server with openssl 1.0.1e version.

Hope this helps someone new to the ssl setup.

0

Try removing SSLCipherSuite and change the SSLProtocol line to:

SSLProtocol -All +TLSv1.1 +TLSv1.2

The SSLCipherSuite will, I believe, override the SSLProtocol in the case where it follows in the configuration file.

8
  • Thank you for the answer but, I have already tried: SSLProtocol -All +TLSv1.1 +TLSv1.2 and tried it now without the bold CipherSuite, the server does not start. The CipherSuite should not cause a problem. And if i debug i get a syntax error: SSLProtocol: Illegal protocol 'TLSv1.1'
    – deltaRoot
    Oct 22, 2014 at 10:22
  • Interesting... The documentation [1] says it should have worked. [1] httpd.apache.org/docs/current/mod/mod_ssl.html#sslprotocol
    – kronenpj
    Oct 22, 2014 at 12:53
  • That is what puzzles me. Do you think Apache needs to be re-compiled?
    – deltaRoot
    Oct 22, 2014 at 13:29
  • Not sure about Apache itself but perhaps mod_ssl. Also, you might try SSLProtocol All -SSLv2 -SSLv3 -TLSv1 instead of starting with -All
    – kronenpj
    Oct 22, 2014 at 14:19
  • Do you happen to know how the best way to compile mod_ssl or shall i open a new question? Tried that, I get "Operation Failed" and no information whatsoever through the debug
    – deltaRoot
    Oct 22, 2014 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .