3

I have been asked to enable 3DES cipher for compatibility reasons on a debian 7 server with up-to-date openssl 1.0.1t.
I finally find out the issue, the site is only working with TLS and it seems openssl 1.0.1t on Debian 7 do not support 3DES cipher for TLS:

-#openssl ciphers -v 'ALL:COMPLEMENTOFALL' | grep DES
ECDHE-RSA-DES-CBC3-SHA  SSLv3 Kx=ECDH     Au=RSA  Enc=3DES(168) Mac=SHA1
ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH     Au=ECDSA Enc=3DES(168) Mac=SHA1
SRP-DSS-3DES-EDE-CBC-SHA SSLv3 Kx=SRP      Au=DSS  Enc=3DES(168) Mac=SHA1
SRP-RSA-3DES-EDE-CBC-SHA SSLv3 Kx=SRP      Au=RSA  Enc=3DES(168) Mac=SHA1
SRP-3DES-EDE-CBC-SHA    SSLv3 Kx=SRP      Au=SRP  Enc=3DES(168) Mac=SHA1
EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
EDH-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  Enc=3DES(168) Mac=SHA1
AECDH-DES-CBC3-SHA      SSLv3 Kx=ECDH     Au=None Enc=3DES(168) Mac=SHA1
ADH-DES-CBC3-SHA        SSLv3 Kx=DH       Au=None Enc=3DES(168) Mac=SHA1
ECDH-RSA-DES-CBC3-SHA   SSLv3 Kx=ECDH/RSA Au=ECDH Enc=3DES(168) Mac=SHA1
ECDH-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=3DES(168) Mac=SHA1
DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
PSK-3DES-EDE-CBC-SHA    SSLv3 Kx=PSK      Au=PSK  Enc=3DES(168) Mac=SHA1

Do you know a way to enable this cipher or is it a compilation option of the SSL package, I couldn't find the proper answer on the Internet.
Thank you.

Edit 1 The application to configure is apache2: 

-# apache2 -v
Server version: Apache/2.2.22 (Debian)
Server built:   Jul 20 2016 05:07:11
Improve this question
2
  • 1
    Which application is using the openssl suite?
    – Iñaki Murillo
    Oct 27, 2016 at 10:05
  • @IñakiMurillo see the edit, apache2.2
    – Kiwy
    Oct 27, 2016 at 10:45

2 Answers 2

Reset to default
2

TLDR: yes they are supported, and probably enabled

The SSLv3 in ciphers -v output is the minimum protocol where a ciphersuite works. In 1.0.1 and up all ciphersuites originally defined in or for SSLv3 are also supported and permitted in TLSv1.0 TLSv1.1 and TLSv1.2, although you should not use SSLv3 protocol at all due to POODLE (and RC4).

This formerly included the export and single-DES suites that were officially deleted by 4346 and deprecated by 5246 respectively, but recent patches of 1.0.1 and 1.0.2 deleted these entirely (even for TLSv1.0 and SSLv3 if unwisely used) from the default build. Similarly IDEA remains usable in all protocols even though 5246 deprecated it. In contrast AEAD and SHA2 ciphersuites are only supported in TLSv1.2 and not lower, but no 3DES ciphersuites are either AEAD or SHA2.

The upstream DEFAULT cipherlist enables all non-anonymous 3DES ciphersuites, so not even config should be needed unless Debian has changed this.

This is essentially the same as this answer of mine on security.SX

Improve this answer
0
0

You have to edit your Apache configuration file and add the cipher suite that you want inside SSLCipherSuite.

Please, have a look at this apache how-to.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .