11

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers.

On their blog, they suggest a configuration for Apache 2.4 that should get an "A" grade in their ssltest, but the configuration [predictably] doesn't earn an "A" in Apache 2.2.

Does anybody know if it's possible to get an "A" with Apache 2.2 on this test? If so, how?

5 Answers 5

10

Apache 2.2.26 added support for ephemeral Elliptic curve Diffie–Hellman (ECDHE). This is likely what is preventing your ability to get an A on on the test. Some Internet Explorer browsers will prefer non-forward secrecy cipher suites when ECDHE is not available. This can also depends on if you prefer the server cipher order and other factors.

4
  • Thank you. I'm using 2.2.22-1 (on Ubuntu 12.04), so it looks like I'm stuck until I upgrade Apache. Mar 17, 2014 at 15:33
  • are you sure the ciphers used depend on the apache-version and not the openssl-version? Apr 6, 2014 at 10:58
  • 1
    @thatguyfromoverthere yes, you can look at the Apache changelog under 2.2.26 and see "mod_ssl: enable support for ECC keys and ECDH ciphers. Tested against OpenSSL 1.0.0b3." Apr 8, 2014 at 14:24
  • i see, thanx; forgot about mod_ssl Apr 8, 2014 at 19:56
8

The site at http://cipherli.st has config snippets for setting up Qualys-rated A-Grade TLS for Apache, nginx and lighttpd. It also includes statements for HSTS, OCSP-Stapling and X-Frame-Options.

4
  • Why was this downvoted?
    – heipei
    Oct 20, 2014 at 8:19
  • I'm guessing because this doesn't really answer the question, and looks a lot like spam. Links are fine as long as you also include a summary of the content of that page, otherwise it is of little value, and may become obsolete.
    – Rory Alsop
    Oct 20, 2014 at 16:54
  • I think the main problem can be seen in the snippets comments : # Requires Apache >= 2.4 + ECDH is not supported by apache <2.2.26 and DHE is not supported by some browsers. Yet the link might interest a few people
    – Cerber
    Oct 23, 2014 at 15:21
  • This gets me an A+ on Apache 2.2, even using the link for legacy and old software (2 paragraphs down).
    – thebjorn
    Feb 7, 2016 at 3:48
1

make a screenshot of the result-page; there are always some links to documentation when testing a server, and a lot of hints on what do do to improve to get a rank A :

are you sure you followed those guides for your setup? beside pfs you need hsts enabled to get an A

iirc the available ciphers doesnt depend on the apache-version, but on the openssl-version used

2
  • "you need hsts enabled to get an A" -- This doesn't seem to be true as of 20151114 . I think you do need it for some of the higher grades though (A isn't the top grade, there is at least A+ and maybe more) Nov 14, 2015 at 1:54
  • @PeterGreen: yes, this answer doesnt reflect the currrent setup, i'll update it as soon as possible Jan 2, 2016 at 9:28
1

The Mozilla SSL Configuration Generator suggests configurations for your Webserver and openSSL version and also tells you which clients will be able to connect.

Your best try might be to use the modern profile for Apache 2.2.31.

-1

Use the following SSL options in your apache config:

SSLProtocol -all +TLSv1.2 +TLSv1.1 +TLSv1 -SSLv3 -SSLv2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.