I am using SSL Certificate issued by Go Daddy. On my Linux Instance following are the software details :-
- Apache Version - Apache/2.4.16 (Amazon)
- Openssl Version - OpenSSL 1.0.2c 12 Jun 2015
- mod_ssl version - mod_ssl-2.4.2
Note :- I install Apache from RPM Package and later I install mod_ssl and openssl from source code.
1) The problem is when I disable SSLv3 and test SSL Server from https://www.ssllabs.com/ssltest/ it gives me warning that "this server does not support TLSv1.2 which is current best" and when I enable TLSv1.2 protocol the same test warns me about "This server supports SSLv3 protocol and vulnerable to Poodle attack" How to disable SSLv3 and enable TLSv1.2 at same time on server? Current configuration of my Vhost file about SSL is:
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder on
2) I cannot create a Strong Diffie-Hellman Group. Current is 1024-bit Diffie-Hellman group and want to create 2048-bit group for the site. I issue this command to generate 2048-bit key:-
openssl dhparam -out dhparams.pem 2048
and my configuration in VHost is:
SSLOpenSSLConfCmd DHParameters /etc/httpd/dhparams.pem
when I restart server error message pop up:
Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration
How to resolve this issue?