9

In Debian 10, the upgraded OpenSSL package has more secure defaults (per https://wiki.debian.org/ContinuousIntegration/TriagingTips/openssl-1.1.1) which causes problems for some of my existing application configurations.

Changing /etc/ssl/openssl.cnf to use CipherString = DEFAULT@SECLEVEL=1 keeps my old configurations working but of course that's a system-wide change.

What I am wondering is if it is possible to keep the system default of CipherString = DEFAULT@SECLEVEL=2 and change this setting at a more granular level?

Specifically, I would like to change the setting on a per-site level in Apache if possible.

Improve this question
3
  • The setting is typically per application. For Apache, look at httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslciphersuite
    – Patrick Mevzek
    Aug 29, 2019 at 5:29
  • @PatrickMevzek I believe the CipherString is different from the SSLCipherSuite (i.e. I can't see how to specify a SSLCipherSuite directive that is functionally identical to the openssl.cnf CipherString options)
    – blihp
    Aug 30, 2019 at 3:06
  • 4
    /etc/ssl/openssl.cnf is just a default OpenSSL configuration, it is not necessarily used by applications. You are not clearly specifying which applications you use that depend on this file. The two are the same thing: do openssl ciphers -s -v 'ALL:@SECLEVEL=2' and you will the specific ciphers that are included, which you can use then in your Apache configuration. Also search for SECLEVEL on access.redhat.com/articles/3652701 you will see you can use it directly in Apache configuration...
    – Patrick Mevzek
    Aug 30, 2019 at 3:11

1 Answer 1

Reset to default
2
  • Override system default with user level environment:
    • An empty file will do: touch ~/.openssl.cnf
    • BASH define & export: export OPENSSL_CONF=~/.openssl.cnf
  • Wrap application within a script: export OPENSSL_CONF=/dev/null
Improve this answer
2
  • I think that this answers the opposite to the original question.
    – Jaime Hablutzel
    Dec 26, 2020 at 22:00
  • Yes, original question is for per site granularity. I point out user level granularity may be useful if per site remains elusive.
    – Conrad T. Pino
    Dec 28, 2020 at 3:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .