1

I'm trying to get my system to pass a BEAST scan, it seems no matter what settings I use, an error is always returned stating that TLS 1.0 is enabled.

I'm using Qualys SSL Labs to test

Apache/2.2.15 (Unix) CentOs 6.5 Final

httpd.conf:

SSLProtocol all -SSLv2 -SSLv3

SSLHonorCipherOrder on

SSLCipherSuite AES256+EECDH:AES256+EDH

Error: BEAST ATTACK Not mitigated server-side (more info) TLS 1.0: 0x39

Upgrading to Apache 2.4 is not an option.

How do I protect my box from a BEAST attack with these version of Centos and Apache?

1

Just wanted to answer this for anyone else who runs into this since there isn't anything specific available.

Using the site I provided Qualys SSL Labs provides the preferred ciphers to use to meet certain requirements.

Verify which ciphers your OpenSSL version supports running:

openssl ciphers -v

Using the list of ciphers available in your OpenSSL cipher suite, compare with Qualys (or similar website) recommendations of ciphers to use for each browser / system you want to support.

Example: Windows 8.1 / IE 11

The top preferred cipher is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, using the website as reference, use the output from your OpenSSL ciphers, go down the list of preferred until you find one that matches up with the ones that are supported and add to your apache httpd.conf file, restart the services and you're done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.