0

We are using ubuntu server with apache 2.4 For PCI-DSS compliance need to disable 1024 bit Diffie Helman, SHA1, DES-CBS-SHAencryption and hashing ciphers.

currently I am using below settings.

SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!3DES:!DES:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!MEDIUM

How to check and disable 1024 bit Diffie Helman, SHA1, DES-CBS-SHA on ubuntu Apache server.

  • 1
  • @yzT, that's the correct answer. Post it and it will get upvoted. – John Deters May 24 '17 at 19:42
  • There is no security reason to avoid ciphersuites using HMAC-SHA1 and unless you can go TLS1.2 only/minimum (as the answer proposes) it's not even possible. You must not use a certificate signed with SHA1 but all decent CAs have already been enforcing that for several years. – dave_thompson_085 May 25 '17 at 6:53
0

Mozilla has a config generator to help you if you are not aware about what you should and you should not add to a config file.

Here's the link https://mozilla.github.io/server-side-tls/ssl-config-generator/

In your case, for Apache 2.4 your config should be similar to

<VirtualHost *:443>
    ...
    SSLEngine on
    SSLCertificateFile      /path/to/signed_certificate_followed_by_intermediate_certs
    SSLCertificateKeyFile   /path/to/private/key

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication


    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=15768000"
    ...
</VirtualHost>

# modern configuration, tweak to your needs
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling          on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache        shmcb:/var/run/ocsp(128000)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.