2

My SSL test result was an A- due to forward secrecy.

I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy

Specifically the lines:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

In my apache2.conf file I have an SSLProtocol line and then below that I can place the SSLCipherSuite line, that's where I assume these forward secrecy fix lines are supposed to go.

For example from this question here:

https://community.qualys.com/thread/11796

I see their SSLCipherSuite line as:

ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL

Looking at the Apache SSL doc I see the pattern above.

I just don't know how to put three lines, are they separated by commmas, or use three separate lines, or do those lines go somewhere else?

closed as off-topic by Steffen Ullrich, WhiteWinterWolf, Neil Smithline, Graham Hill, wireghoul Jun 29 '16 at 1:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, WhiteWinterWolf, Graham Hill, wireghoul
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    They will all come on a single line separated by a colon. Use mozilla.github.io/server-side-tls/ssl-config-generator for generating the SSL conf for your server. – void_in Jun 26 '16 at 8:17
  • @void_in Thanks for your response. I will check out that link. – Jacob David Cunningham Jun 26 '16 at 8:46
  • @void_in Just a quick question, am I supposed to keep the TLS_ in front of the ECDHE_RSA... for example? I tried both and my server went down. I use KATE for a text editor/IDE and the HonorCipherOrder wasn't highlighted (usually suggests invalid/not-supported) but I see it on that link that you sent. Actually I think I know what I did wrong. – Jacob David Cunningham Jun 26 '16 at 8:59
  • still broken, probably should have mentioned that I'm using Apache 2.4.10 – Jacob David Cunningham Jun 26 '16 at 9:05
  • This is not a question about information security but about the exact syntax of a specific setting in the server configuration. Thus it would be more relevant for serverfault.com. But since such information can easily be found using a search engine or by looking at the servers documentation I recommend to close the question rather than to move it. – Steffen Ullrich Jun 26 '16 at 9:23
1

These are NOT lines:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

These are ciphers and should go inside the SSLCipherSuite in appropriate form.

Implementation:

First, make sure that there is no other SSLCipherSuite (except vhosts) that may override your new cipher suite settings. If there is, comment it.

Then, below the commented line or below SSLProtocol line paste your cipher suite. It should look for example like this:

SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:!DSS

Explanation:

  • the first is directive (SSLCipherSuite) for Apache server
  • ciphers (e.g. DHE-RSA-AES128-SHA256) or cipher groups (e.g. DSS) are separated by colon (:)
  • exclamation mark after a colon means that this cipher or group should be left out
  • plus after colon means that this cipher or group should go at the end

By the way, don´t use the cipher suite you mentioned in question. RC4 is obsolete and prohibited in TLS since over a year. (Thanks @Michael Kjörling)

  • Thanks for your post. My problem might be that I'm missing double-quotes around the cipher-suite string, I also didn't know about the !DSS part. Someone showed me their settings that got them an A+ SSL rating. I will implement your response and see what happens thanks for your time. – Jacob David Cunningham Jun 26 '16 at 13:09
  • In Apache config, you do not use quotes around directive values. This syntax is used in Nginx. – Vilican Jun 26 '16 at 14:05
  • @JacobDavidCunningham - By the way, the cipher suite I posted I am actually using and I am getting A+ - proof – Vilican Jun 26 '16 at 14:12
  • 1
    RC4 isn't merely obsolete. RC4 ciphersuites are prohibited in TLS since over a year, and currently Qualys SSL Labs cap grades to C for hosts that talk RC4 with "modern protocols". (They cap grades to B for hosts that talk RC4 with "older protocol versions" only, but that's little comfort if the client or server can be tricked into downgrading to earlier protocols without any warning or error.) See also RC4 in TLS is Broken: Now What? (March 2013). – a CVn Jun 26 '16 at 16:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.