Cannot disable SSLv3 on Amazon Linux Instance

Question

I am using SSL Certificate issued by Go Daddy. On my Linux Instance following are the software details :-

• Apache Version - Apache/2.4.16 (Amazon)
• Openssl Version - OpenSSL 1.0.2c 12 Jun 2015
• mod_ssl version - mod_ssl-2.4.2

Note :- I install Apache from RPM Package and later I install mod_ssl and openssl from source code.

1) The problem is when I disable SSLv3 and test SSL Server from https://www.ssllabs.com/ssltest/ it gives me warning that "this server does not support TLSv1.2 which is current best" and when I enable TLSv1.2 protocol the same test warns me about "This server supports SSLv3 protocol and vulnerable to Poodle attack" How to disable SSLv3 and enable TLSv1.2 at same time on server? Current configuration of my Vhost file about SSL is:

SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder     on

2) I cannot create a Strong Diffie-Hellman Group. Current is 1024-bit Diffie-Hellman group and want to create 2048-bit group for the site. I issue this command to generate 2048-bit key:-

openssl dhparam -out dhparams.pem 2048

and my configuration in VHost is:

SSLOpenSSLConfCmd DHParameters /etc/httpd/dhparams.pem

when I restart server error message pop up:

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

How to resolve this issue?

Answer 1

For apache http server, try:

SSLProtocol -all +TLSv1

Answer 2

Since you are deploying your instance in Amazon, I guess you were following this tutorial as I was doing: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-an-instance.html

In that tutorial, you are kind of encouraged to use Letsencrypt to obtain a free CA, which I also did. After a lot of research trying to alter the ssl.conf file without any success, I found out that Letsencrypt has its own configuration file that overrides whatever you type in the ssl.conf file. Just navigate to

./etc/letsencrypt/options-ssl-apache.conf

and type in your changes there as you were instructed to do in the ssl.conf file. After that, just restart apache and your alterations should now take effect.