0

We are using Ubuntu server with apache 2.4. For PCI-DSS compliance we need to disable 1024 bit Diffie Hellman, SHA1, DES-CBC-SHA encryption and hashing ciphers.

currently I am using below settings.

SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!3DES:!DES:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!MEDIUM

How to check and disable 1024 bit Diffie Hellman, SHA1, DES-CBC-SHA on Ubuntu Apache server.

Improve this question
3
  • 1
    mozilla.github.io/server-side-tls/ssl-config-generator
    – user15194
    May 24, 2017 at 17:10
  • @yzT, that's the correct answer. Post it and it will get upvoted.
    – John Deters
    May 24, 2017 at 19:42
  • There is no security reason to avoid ciphersuites using HMAC-SHA1 and unless you can go TLS1.2 only/minimum (as the answer proposes) it's not even possible. You must not use a certificate signed with SHA1 but all decent CAs have already been enforcing that for several years.
    – dave_thompson_085
    May 25, 2017 at 6:53

1 Answer 1

Reset to default
1

Mozilla has a config generator to help you if you are not aware about what you should and you should not add to a config file.

Here's the link https://mozilla.github.io/server-side-tls/ssl-config-generator/

In your case, for Apache 2.4 your config should be similar to

<VirtualHost *:443>
    ...
    SSLEngine on
    SSLCertificateFile      /path/to/signed_certificate_followed_by_intermediate_certs
    SSLCertificateKeyFile   /path/to/private/key

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication


    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=15768000"
    ...
</VirtualHost>

# modern configuration, tweak to your needs
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling          on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache        shmcb:/var/run/ocsp(128000)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .