0

One of my client wanted me to upgrade openssl and Apache on his server because he want to receive an A from SSLLabs. I went ahead and upgraded to Apache 2.4.18 and openssl to version 1.0.2e. I then modified Apache's SSL configuration to match the following:

# SSL Protocols/Ciphers
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256::kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
SSLCompression off

I ran an SSL Test from SSL Labs and I still receive the following warning:

This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C.

In the protocols list, it says YES to SSL 3 even if the above statement says it should be disabled.

I've tried many ciphers combinisations by searching on the web and I always gets the same result. I've also searched in any *.conf file for an SSL configuration but there's none except my SSL file above.

The website's URL: https://orders.expotools.biz

SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=orders.expotools.biz

1

Unable to disable SSLv3 in Apache 2.4.18
...
SSLProtocol All -SSLv2 -SSLv3

Try:

SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2

Also see Apache Module mod_ssl | SSLProtocol in the handbook.

1
  • Not OP, but this did not work for me
    – AllisonC
    Apr 6 '18 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.