0

I have edited the following line in the /etc/httpd/conf.d/ssl.conf configuation and restarted the service.

SSLProtocol All -SSLv2 -SSLv3

But when I run the following it still shows that server is using SSLv2 and SSLv3 also VA report confirms that.

openssl s_client -help 2>&1  > /dev/null | egrep "\-(ssl|tls)[^a-z]"

Any idiea how can I disable all the SSLv2 and SSLv3 communication?

Thank you in advance.

Improve this question
2
  • 2
    openssl s_client -help does not say anything about the configuration of the server. I have no idea how old your server are but SSLv2 and SSLv3 and usually not even compiled into OpenSSL for many years and they are definitely not enabled by default, so there should be nothing to do on recent systems.
    – Steffen Ullrich
    May 21, 2020 at 6:17
  • Any method how can I disable the ssl protocols? like I already disabled in apache. But still it shows that the server is allowing ssl protocols. What are the services I need to re-configure ( like apache, curl and etc).
    – Dinuka Kavinda
    May 22, 2020 at 20:51

1 Answer 1

Reset to default
1

I think your openssl command is causing you some confusion. I think maybe someone was showing you the switches you can use for s_client to enable eg just tls1_3

For a much simpler and more thorough test, try testssl.sh - It'll give you similar details to the qualsys test, but for internal servers. As well as telling you what protocols you're enabling it will also warn about misconfigurations and vulnerabilities: https://testssl.sh/

Improve this answer
2
  • Excellent idea recommending testssl +1
    – Rui F Ribeiro
    May 21, 2020 at 10:54
  • thank you I'll try that
    – Dinuka Kavinda
    May 22, 2020 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .