We are using Ubuntu server with apache 2.4. For PCI-DSS compliance we need to disable 1024 bit Diffie Hellman, SHA1, DES-CBC-SHA encryption and hashing ciphers.

currently I am using below settings.

SSLHonorCipherOrder On

How to check and disable 1024 bit Diffie Hellman, SHA1, DES-CBC-SHA on Ubuntu Apache server.

  • 1
    – user15194
    May 24, 2017 at 17:10
  • @yzT, that's the correct answer. Post it and it will get upvoted. May 24, 2017 at 19:42
  • There is no security reason to avoid ciphersuites using HMAC-SHA1 and unless you can go TLS1.2 only/minimum (as the answer proposes) it's not even possible. You must not use a certificate signed with SHA1 but all decent CAs have already been enforcing that for several years. May 25, 2017 at 6:53

1 Answer 1


Mozilla has a config generator to help you if you are not aware about what you should and you should not add to a config file.

Here's the link https://mozilla.github.io/server-side-tls/ssl-config-generator/

In your case, for Apache 2.4 your config should be similar to

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile      /path/to/signed_certificate_followed_by_intermediate_certs
    SSLCertificateKeyFile   /path/to/private/key

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication

    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=15768000"

# modern configuration, tweak to your needs
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling          on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache        shmcb:/var/run/ocsp(128000)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .