I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl.
I have followed the steps outlined in the documentation (see above link), especially making sure that the NSSProtocol directive reads as follows (according to the docs, this disables all SSL and TLS protocol versions except TLS version 1 and higher):
Then I restarted Apache and tested whether SSLv3 is enabled:
openssl s_client -connect localhost:443 -ssl3
[root@box1 ~]# openssl s_client -connect localhost:443 -ssl3 CONNECTED(00000003) 139894684407712:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 5 bytes and written 7 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1442107224 Timeout : 7200 (sec) Verify return code: 0 (ok) --- [root@box1 ~]#
As you can see, the handshake completes (as indicated by SSL handshake has read 5 bytes and written 7 bytes) so that makes me doubt that SSLv3 has been actually disabled.
I have spent countless hours searching for a solution but everything I've been able to found tells me how to disable SSLv3 through mod_ssl, not mod_nss.
Any ideas or clarifications will be more than welcome.