3

We are trying to disable sslv3 for poodle vulnerability.so i disabled in ssl.conf

SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3

and tried to connect using tlsv1 using openssl command.

openssl s_client -host localhost -port 8001 -tls1

New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Secure Renegotiation IS NOT supported SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: B391D1D3B9EAC8CEF97838AA3A1D1277 Session-ID-ctx:

I am forcing openssl to connect tlsv1 ,but it is still showing sslv3(New, TLSv1/SSLv3, Cipher is AES256-SHA),please let me know why ot shows sslv3 even after disable in ssl.conf?

Thanks Jay

closed as off-topic by Xander, TildalWave, AJ Henderson, schroeder, Adi Oct 26 '14 at 12:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, AJ Henderson, Adi
If this question can be reworded to fit the rules in the help center, please edit the question.

  • "SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3" Did you just disable TLS 1.1 and 1.2!? – Matt Nordhoff Oct 24 '14 at 15:29
5

You're looking at the wrong line.

New, TLSv1/SSLv3, Cipher is AES256-SHA

TLSv1 and SSLv3 use many of the same ciphers. This line is just telling you that the selected cipher is from the TLSv1/SSLv3 family. Further down in the openssl output should be something like this:

SSL-Session:
    Protocol  : TLSv1

This tells you what protocol is in use. In my example, it's TLSv1.

Not the answer you're looking for? Browse other questions tagged or ask your own question.