I purchased the GeoTrust QuickSSL Premium certificate from ssls.com and installed it on my web server which is running Linux Apache on CentOS 6.5.

Google Chrome on Windows 7 said

"The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and ECDHE_RSA as the key exchange mechanism."

The screen shot is as follows.

enter image description here

The certificate path is as follows.

enter image description here

The first part of the certificate details is as follows.

enter image description here

I went to https://knowledge.geotrust.com/support/knowledge-base and it said "Certificate is installed correctly".

I tested my site on www.ssllabs.com/ssltest/analyze.html. It rated my site with an A and said that my signature algorithm is SHA256withRSA. I went to shaaaaaaaaaaaaa.com said

Nice. example.com has a verifiable certificate chain signed with SHA-2.

I went to whynopadlock.com and everything checked out positively.

I set up the intermediate certificate as per the instructions given by GeoTrust.

I went to my web server and added the following to /etc/httpd/conf.d/ssl.conf

<VirtualHost _default_:443>

\# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www"
ServerName www.clusterprism.com:443

\# Added to try to fix Google Chrome's "SHA1 for message authentication" nonsense
SSLEngine on
SSLCertificateFile /etc/httpd/RapidSsl/public.crt
SSLCertificateChainFile /etc/httpd/RapidSsl/intermediateNewName.crt
SSLCertificateKeyFile /etc/httpd/RapidSsl/private.key
SSLCACertificateFile /etc/httpd/RapidSsl/ca-bundle.crt

# intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          !RC4:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder     on

It made no difference

up vote 3 down vote accepted

"The connection ...with SHA1 for message authentication

It is using SHA-1 for message authentication (HMAC), not for certificate signature. Both are unrelated. HMAC is used for the integrity of the messages and the security considerations are different there from the certificate signatures, so it is perfectly fine to use SHA-1 in this case.

  • So is the message about SHA-1 just informational rather than a warning? Thanks, – OtagoHarbour Jun 20 '15 at 10:46
  • 1
    Yes, SHA-1 is fine in the cipher. The "obsolete" message refers to other parts of the cipher, see stackoverflow.com/questions/30270788/… – Steffen Ullrich Jun 20 '15 at 11:17
  • Thank you so much! The solution is given by Anand Bhat at the link you provided. I wish I could give you more up votes. – OtagoHarbour Jun 20 '15 at 15:00
  • I added one, @SteffenUllrich thank you for giving us a friendly spin towards the right direction! – Florian Heigl Mar 3 '16 at 5:45

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.