While disabling SSLv3 from our
ssl.conf files to overcome the Poodle vulnerability, I also disabled the SSLv3 ciphers using
!SSLv3. With the ciphers disabled, we were not able to access the website through Firefox and IE. The following was the error message from Firefox:
An error occurred during a connection to xxxx.example.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)
So we went back and enabled the SSLv3 ciphersuite and it all started working fine. Right now, the SSLv3 protocol is disabled, but the SSLv3 ciphers are enabled.
- Am I assuming correctly that we got the error with one of the browsers because TLS ciphers were not available in the browser?
- Is it possible that the protocol used is TLSv3, but the ciphers are of SSLv3?
SSLProtocol all -SSLv2 -SSLv3 #SSLProtocol -all +SSLv3 # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:!MEDIUM:!LOW
We can upgrade the browsers at our office, but can't do that on our customer's machines. Is having SSLv3 protocol disabled, but with the ciphers enabled a recommended setup? In other words, are we okay with connecting through TLS with SSLv3 ciphers?