0

I have edited the following line in the /etc/httpd/conf.d/ssl.conf configuation and restarted the service.

SSLProtocol All -SSLv2 -SSLv3

But when I run the following it still shows that server is using SSLv2 and SSLv3 also VA report confirms that.

openssl s_client -help 2>&1  > /dev/null | egrep "\-(ssl|tls)[^a-z]"

Any idiea how can I disable all the SSLv2 and SSLv3 communication?

Thank you in advance.

2
  • 2
    openssl s_client -help does not say anything about the configuration of the server. I have no idea how old your server are but SSLv2 and SSLv3 and usually not even compiled into OpenSSL for many years and they are definitely not enabled by default, so there should be nothing to do on recent systems. – Steffen Ullrich May 21 '20 at 6:17
  • Any method how can I disable the ssl protocols? like I already disabled in apache. But still it shows that the server is allowing ssl protocols. What are the services I need to re-configure ( like apache, curl and etc). – Dinuka Kavinda May 22 '20 at 20:51
1

I think your openssl command is causing you some confusion. I think maybe someone was showing you the switches you can use for s_client to enable eg just tls1_3

For a much simpler and more thorough test, try testssl.sh - It'll give you similar details to the qualsys test, but for internal servers. As well as telling you what protocols you're enabling it will also warn about misconfigurations and vulnerabilities: https://testssl.sh/

2
  • Excellent idea recommending testssl +1 – Rui F Ribeiro May 21 '20 at 10:54
  • thank you I'll try that – Dinuka Kavinda May 22 '20 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.