11

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers.

On their blog, they suggest a configuration for Apache 2.4 that should get an "A" grade in their ssltest, but the configuration [predictably] doesn't earn an "A" in Apache 2.2.

Does anybody know if it's possible to get an "A" with Apache 2.2 on this test? If so, how?

10

Apache 2.2.26 added support for ephemeral Elliptic curve Diffie–Hellman (ECDHE). This is likely what is preventing your ability to get an A on on the test. Some Internet Explorer browsers will prefer non-forward secrecy cipher suites when ECDHE is not available. This can also depends on if you prefer the server cipher order and other factors.

  • Thank you. I'm using 2.2.22-1 (on Ubuntu 12.04), so it looks like I'm stuck until I upgrade Apache. – Mark E. Haase Mar 17 '14 at 15:33
  • are you sure the ciphers used depend on the apache-version and not the openssl-version? – that guy from over there Apr 6 '14 at 10:58
  • 1
    @thatguyfromoverthere yes, you can look at the Apache changelog under 2.2.26 and see "mod_ssl: enable support for ECC keys and ECDH ciphers. Tested against OpenSSL 1.0.0b3." – John Downey Apr 8 '14 at 14:24
  • i see, thanx; forgot about mod_ssl – that guy from over there Apr 8 '14 at 19:56
8

The site at http://cipherli.st has config snippets for setting up Qualys-rated A-Grade TLS for Apache, nginx and lighttpd. It also includes statements for HSTS, OCSP-Stapling and X-Frame-Options.

  • Why was this downvoted? – heipei Oct 20 '14 at 8:19
  • I'm guessing because this doesn't really answer the question, and looks a lot like spam. Links are fine as long as you also include a summary of the content of that page, otherwise it is of little value, and may become obsolete. – Rory Alsop Oct 20 '14 at 16:54
  • I think the main problem can be seen in the snippets comments : # Requires Apache >= 2.4 + ECDH is not supported by apache <2.2.26 and DHE is not supported by some browsers. Yet the link might interest a few people – Cerber Oct 23 '14 at 15:21
  • This gets me an A+ on Apache 2.2, even using the link for legacy and old software (2 paragraphs down). – thebjorn Feb 7 '16 at 3:48
1

make a screenshot of the result-page; there are always some links to documentation when testing a server, and a lot of hints on what do do to improve to get a rank A :

are you sure you followed those guides for your setup? beside pfs you need hsts enabled to get an A

iirc the available ciphers doesnt depend on the apache-version, but on the openssl-version used

  • "you need hsts enabled to get an A" -- This doesn't seem to be true as of 20151114 . I think you do need it for some of the higher grades though (A isn't the top grade, there is at least A+ and maybe more) – Peter Green Nov 14 '15 at 1:54
  • @PeterGreen: yes, this answer doesnt reflect the currrent setup, i'll update it as soon as possible – that guy from over there Jan 2 '16 at 9:28
1

The Mozilla SSL Configuration Generator suggests configurations for your Webserver and openSSL version and also tells you which clients will be able to connect.

Your best try might be to use the modern profile for Apache 2.2.31.

-1

Use the following SSL options in your apache config:

SSLProtocol -all +TLSv1.2 +TLSv1.1 +TLSv1 -SSLv3 -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.