Apache / OpenSSL configuration keywords `SSLProtocol` vs. `SSLCipherSuite`

Question

According to the Apache docs I can configure the cipher suite with (a.o.) two different keywords and examples on Internet often use both (but not necessarily identical to below example).

What is the difference between SSLProtocol and SSLCipherSuite, should I use them either or both?

SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ALL:!SSLv2:!SSLv3

Or is it better to list individual ciphers for SSLCipherSuite?

SSLCipherSuite ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:RC4-SHA ...

Are both keywords fundamentally different in what they configure? I have this feeling I am overlooking something essential here.

Above configurations are not necessarily good practice, they're just an example to explain my doubt.

Answer 1

SSLProtocol configures which protocols (SSL or TLS) and which specific versions of those protocols will be allowed.

For example this:

SSLProtocol all -SSLv2 -SSLv3

means enable all supported protocols except SSLv2 and SSLv3.

SSLCipherSuite configures which cipher suites can be used. Each of the protocols support different overlapping sets of ciphers; with this you can apply a fine grained setting of exactly which ciphers you want to allow.

In addition to specifying lists of individual ciphers, you can also use aliases such as SSLv3 (which means all ciphers allowed by the SSLv3 protocol) or TLSv1 (all ciphers allowed by the TLSv1 protocol).

If you want to control which protocols are supported, then you should use SSLProtocols, because it explicitly states that the given protocols will not be allowed, rather than relying on blocking the use of all the ciphers that the protocols allow.