1

I am using CentOS 5 with Apache2.

Into an additional config file:

/etc/apache2/conf/extra/ssl.conf

I have put these lines:

SSLHonorCipherOrder On 
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 
SSLCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

I still can't enable TLSv1.3. The error says when restarting the service

Starting httpd: Syntax error on line 113 of /etc/apache2/conf/extra/ssl.conf: 
SSLProtocol: Illegal protocol 'TLSv1.3'

System: CentOS 5.11 (Final).

OpenSSL: 1.1.1a 20 Nov 2018.

8
  • 3
    Can you provide the version details for your OS, Apache & OpenSSL?
    – Haxiel
    Jan 22, 2019 at 11:07
  • Did you show us line 113? I don't see a TLSv1.3 entry...?
    – Jeff Schaller
    Jan 22, 2019 at 11:22
  • Centos 5 is too old to support that, I think. What have you installed? Jan 22, 2019 at 13:48
  • hi, my OS is CentOS release 5.11 (Final). Openssl is OpenSSL 1.1.1a 20 Nov 2018
    – jonathan
    Jan 28, 2019 at 10:41
  • @JeffSchaller .. the error is when i put the SSLProtocol TLSv1.3
    – jonathan
    Jan 28, 2019 at 10:44

1 Answer 1

0

Note that you would need the very latest Apache version in order for the following to work:

SSLProtocol -all +TLSv1.3 +TLSv1.2

This is simpler than disabling all of the other obsolete protocols.


And then you need to define pre-TLSv1.3 cipher suites separately. Like so:

SSLCipherSuite    TLSv1.3   TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
SSLCipherSuite    SSL       ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
5
  • thanks for your respond. but after I added the suggested lines, got error: Starting httpd: Syntax error on line 108 of /etc/apache2/conf/extra/ssl.conf: SSLProtocol: Illegal protocol 'TLSv1.3' [FAILED] can you help me out of this. I appreciates much.
    – jonathan
    Jan 28, 2019 at 11:30
  • @jonathan.rtz Post your openssl version. Jan 28, 2019 at 13:08
  • here it is my OS is CentOS release 5.11 (Final). Openssl is OpenSSL 1.1.1a 20 Nov 2018
    – jonathan
    Jan 29, 2019 at 1:56
  • ok. thank you! i will wait. thanks again.
    – jonathan
    Jan 29, 2019 at 7:57
  • Is there any configuration that I should add or maybe I miss out in my ssl.conf? TSL1.3 is still disabled.
    – jonathan
    Jan 31, 2019 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.