-1

I am having no luck disabling SSL3 on CentOS 6. I have followed guides and forum posts to no avail.

grep -Ri SSLProtocol /etc/httpd
Binary file /etc/httpd/modules/mod_ssl.so matches
/etc/httpd/conf.d/ssl.conf:SSLProtocol all -SSLv2 -SSLv3
/etc/httpd/conf.d/ssl.conf:#SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2

Do I need to do something to change/enable it for vhosts? Further down the file it has a hosts section - ## SSL Virtual Host Context ## # - but it's all commented out. There's no virtual host sections in use.

  • 2
    How are you testing that httpd is still using SSLv3? – Braiam Nov 28 '14 at 17:21
0

First step is to identify where your site is being defined. Typically the apache configs will pull in a bunch of defaults from the /etc directory, but then include per-site files outside that path. Grep for "Include" lines.

In the setups I've used, there is a separate VirtualHost for the non-SSL and SSL versions of the site, and all the SSL settings are specified in that VirtualHost block, and these override anything in the defaults.

Also, make sure apache was really restarted by stopping it and ensuring nothing is listening on port 80, and then starting it.

I assume you're using something like https://www.ssllabs.com/ssltest/ to test?

0

Thankyou for your help. I wasn't having much luck using grep to find answers.

I think the problem was that I have Plesk installed. Sorry I forgot to mention!

I followed the instructions here - http://kb.sp.parallels.com/en/123160 - and ran the script. It fixed everything. Removed SSLv3, enabled TLSv1.1 & 1.2, and made my server grade on SSLLabs jump from C to A :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.