SSLCipherSuite !3DES not working

Question

Following advice I've seen here and other places, I am trying to remove support on our server for these two suites that flunk the SSL Labs Server test:

TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

I would have thought that setting SSLCipherSuite to:

HIGH:!aNULL:!eNULL:!DES:!3DES:!ADH:!EXP:!NULL:!RC4

would disallow anything with 3DES, but SSL Labs test still shows these two "weak" ciphers as supported. I tried adding

:!DES-CBC3-SHA:!ECDHE-RSA-DES-CBC3-SHA

to that setting and doing a restart (Apache graceful), but it does not change.

SSLProtocol is set to:

-ALL -SSLv2 -SSLv3 +TLSv1.2

(is the -SSLv2 and v3 redundant?)

What am I missing?

Answer 1

Probably solved by now but, had the exact same problem, lost will to live but then found out it was letsencrypt:

https://www.andrewshay.me/blog/apache-disable-tls_rsa_with_3des_ede_cbc_sha-after-letsencrypt/

I was grepping on CipherSuite in my apache install folder but lets encrypt includes a file outside of it.

Answer 2

The SSLCipherSuite you show looks fine for reaching the goal you state (remove 3DES) which can be seen when using it inside

openssl ciphers -V 'HIGH:!aNULL:!eNULL:!DES:!3DES:!ADH:!EXP:!NULL:!RC4'

This shows the ciphers which should be accepted by your server and it can be seen that there is no 3DES anymore.

If the test of the server shows different then you might be either testing a different server then the one you've configured or this setting does not get applied, maybe because there is another SSLCipherSuite somewhere in your configuration or the restart was unsuccessful and the previous configuration is still in use.

Apart from that I recommend to follow the guidelines from Mozilla to configure your server. They provide proper configurations regarding ciphers and protocol version for the major SSL servers and these should better be used instead of making up your own unless you really know what you do.