I know that there are some Questions around here that comes along with this Topic. But I really don't know what I can do anymore.
So here's the point:
- I am using Apache 2.2.22 on OpenSuse 12.3.
- The SSLProtocol option is in my ssl.conf
I have tried out all of this options:
SSLProtocol ALL -SSLv2 -SSLv3 ---------- SSLProtocol +TLSv1 -SSLv2 -SSLv3 ---------- SSLProtocol TLSv1 ---------- SSLProtocol -ALL TLSv1 ----------
But what ever I try, still all Protocol are available...
Why can't I disable it?
So i have tried so much out that i want to recap it:
I only have one declaration of SSLProtocol and it doesn't matter where I put it (in my vhost conf or my ssl-default conf).
I know that it is loaded, because the denying of all protocols with the option "-all" works fine. The denying of a special protocol doesn't work (like the option -SSLv3). If one protocol is allowed, every protocol is available (for example with "SSLProtocol TLSv1 -SSLv2 -SSLv3" or "SSLProtocol -all TLSv1" every protocol is available!).