6

I'm running Apache 2.4.7 on an Ubuntu 14.04 ("Trusty") server. The Ubuntu-specific package identifier is "2.4.7-1ubuntu4.1".

If one does not explicitly specify DH/ECDH parameters (see below), Apache uses the standard DH parameters from RFC 3526 for discrete-log DH. The length of the parameter is matched to the length of the RSA public key (e.g. a 2048-bit RSA key gets a 2048-bit DH parameter, 4096-bit RSA key gets a 4096-bit DH parameter, etc.).

It appears that only the NIST P-256 cuve is used for ECDH regardless of the size of the RSA or ECDSA public key.

The Apache documentation indicates that, in addition to a site's SSL certificate, one can manually specify DH or ECDH parameters in the file referenced by the SSLCertificateFile directive in a site's configuration file.

The exact text of the relevant entry in the docs is:

Additional optional elements are DH parameters and/or an EC curve name for ephemeral keys, as generated by openssl dhparam and openssl ecparam, respectively (supported in version 2.4.7 or later) and finally, the end-entity certificate's private key.

However, it appears that Apache only reads the first DH and first ECDH parameters declared in this way. Additional sets of parameters declared in that file are ignored.

Is it possible to declare multiple sets of parameters so that clients could choose which one to use for DH/ECDH?

Specifically, I'd like to declare multiple acceptable elliptic curves for ECDH.

For example, I would like to have secp256r1 available for compatibility reasons, but also offer secp384r1 and secp521r1 to clients who support such curves.

Additionally, it would be nice to have 1024-bit DH parameters available for legacy clients, but 2048-bit or higher parameters for newer clients that support longer primes.

Is it possible to declare multiple sets of DH and ECDH parameters and I'm simply missing something, or is it only possible to explicitly declare one set of DH and ECDH parameters, respectively?

Improve this question
3
  • Have you confirmed, that Apache2.4.7 really uses your DH parameters? I've found out, that Apache under Ubuntu 14.04, although the Apache2.4 manual states otherwise, always uses the DH parameters specified in RFC 3526. You can check that by analyzing the output of the -msg switch of s_client (see here and here )
    – r_3
    May 26, 2015 at 11:35
  • @r_3 Good question. Yes, it's using my DH parameters. Here's a snip from the relevant commands: From "openssl dhparam -text" showing the custom parameters I'm using: 00:da:71:c8:f2:c6:66:a5:0a:11:cd:14:f3:c0:e3 From "openssl s_client" showing the parameters sent by Apache to a client: da 71 c8 f2 c6 66 a5 0a 11 cd 14 f3 c0 e3 2d e3 Other than the null start byte the parameters are the same. If I change the DH parameters used, Apache correctly interprets and sends those parameters as well.
    – heypete
    May 27, 2015 at 12:10
  • thank you for checking.- I was thinking about opening a bug report because my DH parameters remain the same. One more question: do you have a SNI-setup running on this Ubuntu14.04 machine or is it only serving one certificate?
    – r_3
    May 27, 2015 at 14:59

3 Answers 3

Reset to default
3

There's no way to do it for non-EC DH.

For ECDH:

SSLOpenSSLConfCmd ECDHParameters prime256v1
SSLOpenSSLConfCmd Curves brainpoolP512r1:secp521r1:brainpoolP384r1:secp384r1:brainpoolP256r1:prime256v1
Improve this answer
5
  • According to httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslopensslconfcmd SSLOpenSSLConfCmd is only "Available in httpd 2.4.8 and later, if using OpenSSL 1.0.2 or later".
    – Christopher Rüprich
    May 21, 2015 at 10:19
  • surely anyone running 2.4.7 can easily update to a newer 2.4.x version?
    – lily wilson
    May 22, 2015 at 0:47
  • @lilywilson Not necessarily. Many people -- myself included -- prefer to use packages provided by their OS distribution of choice as it makes managing updates considerably easier. In my case, I use Ubuntu 14.04 for its long-term support. Barring a major issue, versions are frozen at release and security/bug fixes are backported but there are no new feature releases. Upgrading to a newer version is possible but non-trivial.
    – heypete
    May 24, 2015 at 22:40
  • if they backport security fixes, then they should have backported support for SSLOpenSSLConfCmd, to allow disabling SHA-1 signatures and preferring openssl's constant time P-256 implementation over it's non-constant-time P-384 and P-521 implementations.
    – lily wilson
    Jun 19, 2015 at 20:19
  • @lilywilson Alas, they did not backport support for SSLOpenSSLConfCmd (I just tested it today) since that's a new feature, not a security fix. As for the other options in OpenSSL, I'm not sure how to test if those features have been backported.
    – heypete
    Apr 28, 2016 at 23:41
3
  1. DH Parameters - This only applies if you plan to use a DHE_RSA_<insert cipher here>. If you do not plan to use any of those ciphers, the point is moot

  2. EC Params - You are required to upgrade to Apache 2.4.8 or greater and have OpenSSL 1.0.2 or greater. Neither of which come in Ubuntu 14.04.x. You will need to do:

    apt-add-repository ppa:ondrej/apache2 #corrected
apt-get update
apt-get upgrade openssl
apt-get upgrade apache2

Once you are on latest Apache2 and OpenSSL libraries, you can update EC ciphers by adding the following line inside your <VirtualHost *:443> container:

SSLOpenSSLConfCmd Curves secp384r1

If you want more then one curve:

SSLOpenSSLConfCmd Curves secp384r1:secp521r1

Then bump the service:

service apache2 restart
Improve this answer
4
  • Your answer shows how one can specify a different EC curve for ECDHE instead of the standard P-256 curve. My question is how can one setup the server to support multiple curves for ECDHE (and pick the strongest, or the fastest, etc.) instead of just supporting a single curve.
    – heypete
    Dec 10, 2015 at 22:30
  • 1
    just make them : separated SSLOpenSSLConfCmd Curves secp384r1:secp521r1
    – EagleEye208
    Dec 11, 2015 at 3:41
  • Unfortunately SSLOpenSSLConfCmd is not supported in Apache 2.4.7, which is the version packaged with Ubuntu 14.04 LTS. Fortunately, 16.04 LTS has just been released and has Apache 2.4.18, so that option will be available as soon as in-place upgrades for Ubuntu Server are available in the next month or two.
    – heypete
    Apr 28, 2016 at 23:43
  • yes, this is why you have to first add the ppa repo :/
    – EagleEye208
    May 3, 2016 at 21:00
1

If you're using apache 2.4.7 and OpenSSL 0.9.8a or later, you can modify DH parameters by appending your dhparam file to the end your certificate files.

No idea about EC params...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .