In Debian 10, the upgraded OpenSSL package has more secure defaults (per https://wiki.debian.org/ContinuousIntegration/TriagingTips/openssl-1.1.1) which causes problems for some of my existing application configurations.

Changing /etc/ssl/openssl.cnf to use CipherString = DEFAULT@SECLEVEL=1 keeps my old configurations working but of course that's a system-wide change.

What I am wondering is if it is possible to keep the system default of CipherString = DEFAULT@SECLEVEL=2 and change this setting at a more granular level?

Specifically, I would like to change the setting on a per-site level in Apache if possible.

  • The setting is typically per application. For Apache, look at httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslciphersuite Aug 29, 2019 at 5:29
  • @PatrickMevzek I believe the CipherString is different from the SSLCipherSuite (i.e. I can't see how to specify a SSLCipherSuite directive that is functionally identical to the openssl.cnf CipherString options)
    – blihp
    Aug 30, 2019 at 3:06
  • 3
    /etc/ssl/openssl.cnf is just a default OpenSSL configuration, it is not necessarily used by applications. You are not clearly specifying which applications you use that depend on this file. The two are the same thing: do openssl ciphers -s -v 'ALL:@SECLEVEL=2' and you will the specific ciphers that are included, which you can use then in your Apache configuration. Also search for SECLEVEL on access.redhat.com/articles/3652701 you will see you can use it directly in Apache configuration... Aug 30, 2019 at 3:11

1 Answer 1

  • Override system default with user level environment:
    • An empty file will do: touch ~/.openssl.cnf
    • BASH define & export: export OPENSSL_CONF=~/.openssl.cnf
  • Wrap application within a script: export OPENSSL_CONF=/dev/null
  • I think that this answers the opposite to the original question. Dec 26, 2020 at 22:00
  • Yes, original question is for per site granularity. I point out user level granularity may be useful if per site remains elusive. Dec 28, 2020 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.