0

Team,

While configure ssl.conf for apache 2.2.4, I want to use some configuration like below

 SSLEngine on
 SSLCertificateFile /opt/alfresco/deploy/ssl/crt/testdns.com.crt
 SSLCertificateKeyFile /opt/alfresco/deploy/ssl/private/testdns.com.key
 SSLCertificateChainFile /opt/alfresco/deploy/ssl/crt/intermediate.crt
 SSLVerifyClient none
 SSLVerifyDepth 1
 SSLOptions +StdEnvVars +StrictRequire
 SSLProtocol -ALL +TLSv1
 SetEnv nokeepalive ssl-unclean-shutdown
 SSLProtocol +TLSv1 +TLSV1.2

When I use +TLSv1 only it gives me some error like below for my API calls

javax.net.ssl.SSLException: Received fatal alert: protocol_version 

If I use both protocols SSLProtocol +TLSv1 +TLSv2 both, it gives browser unsecure icon, how do I prevent it?

Case is like below

If I use only +TLSv1  -  My API calls are working fine
If I use only +TLSv2  - browser shows secure icon but API call fails and give above error.

If I use both still browser shows unsecure icon. Click here to check screenshot()

Is there any solution of it , let me know.

  • If you are using a self-signed certificate, you will need to install the certificate on your local machine. The certificate is not trusted as it did not come from a trusted provider. You can either purchase an SSL certificate from a trusted provider, like Geotrust, or you can use Let's Encrypt, which is a free trusted certificate. – Heysus Escobar Feb 19 '20 at 2:37
  • Certificate is trusted for sure, it is showing secure icon when I use vTLS1.2 – Iván Carvallo Feb 20 '20 at 10:54
0

I configured a web server with the same SSL options from your original post. The only difference is that I'm using a free SSL certificate from CertBot, which is a trusted provided. I was able to get the same results on Chrome and Edge. enter image description here Here is the apache information and virtual host config.

[root@ip-172-26-6-250 conf.d]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

[root@ip-172-26-6-250 conf.d]# httpd -V
Server version: Apache/2.4.6 (CentOS)
Server built:   Aug  8 2019 11:41:18
Server's Module Magic Number: 20120211:24
Server loaded:  APR 1.4.8, APR-UTIL 1.5.2
Compiled using: APR 1.4.8, APR-UTIL 1.5.2
Architecture:   64-bit
Server MPM:     prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=256
 -D HTTPD_ROOT="/etc/httpd"
 -D SUEXEC_BIN="/usr/sbin/suexec"
 -D DEFAULT_PIDLOG="/run/httpd/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"

Here is the virtual host config.

[root@ip-172-26-6-250 conf.d]# cat /etc/httpd/conf.d/heysus_xyz.conf
<VirtualHost *:80>
    DocumentRoot "/var/www/html/"
    ServerName heysus.xyz
</VirtualHost>

##Test Config
<VirtualHost *:443>

    DocumentRoot "/var/www/html/"
    ServerName heysus.xyz
    SSLEngine on
    SSLCertificateFile "/etc/letsencrypt/live/heysus.xyz/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/live/heysus.xyz/privkey.pem"

    SSLVerifyClient none
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +StrictRequire
    SSLProtocol -ALL +TLSv1
    SetEnv nokeepalive ssl-unclean-shutdown
    SSLProtocol +TLSv1 +TLSV1.2
</VirtualHost>

##Working config
#<VirtualHost *:443>
#    DocumentRoot "/var/www/html/"
#    ServerName heysus.xyz
#    SSLEngine on
#    SSLCertificateFile "/etc/letsencrypt/live/heysus.xyz/fullchain.pem"
#    SSLCertificateKeyFile "/etc/letsencrypt/live/heysus.xyz/privkey.pem"
#</VirtualHost>

I think the issue may be with your certificate. Make sure that the certificate is properly installed.

The server I used for testing will be live for a few days so that you can take a look.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.