0

I have edited the following line in the /etc/httpd/conf.d/ssl.conf configuation and restarted the service.

SSLProtocol All -SSLv2 -SSLv3

But when I run the following it still shows that server is using SSLv2 and SSLv3 also VA report confirms that.

openssl s_client -help 2>&1  > /dev/null | egrep "\-(ssl|tls)[^a-z]"

Any idiea how can I disable all the SSLv2 and SSLv3 communication?

Thank you in advance.

2
  • 2
    openssl s_client -help does not say anything about the configuration of the server. I have no idea how old your server are but SSLv2 and SSLv3 and usually not even compiled into OpenSSL for many years and they are definitely not enabled by default, so there should be nothing to do on recent systems. May 21, 2020 at 6:17
  • Any method how can I disable the ssl protocols? like I already disabled in apache. But still it shows that the server is allowing ssl protocols. What are the services I need to re-configure ( like apache, curl and etc). May 22, 2020 at 20:51

1 Answer 1

1

I think your openssl command is causing you some confusion. I think maybe someone was showing you the switches you can use for s_client to enable eg just tls1_3

For a much simpler and more thorough test, try testssl.sh - It'll give you similar details to the qualsys test, but for internal servers. As well as telling you what protocols you're enabling it will also warn about misconfigurations and vulnerabilities: https://testssl.sh/

2
  • Excellent idea recommending testssl +1 May 21, 2020 at 10:54
  • thank you I'll try that May 22, 2020 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .