commit cebdd81b75d4d679fb5b76fb8f5552692a5f21ea
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Mon Oct 26 08:40:47 2015 +0100
Enabling and Disabling SSL and TLS in mod_ssl
en-US/The_Apache_HTTP_Server.xml | 101 +++++++++++++++++++++++++++++++++++++-
1 files changed, 100 insertions(+), 1 deletions(-)
---
diff --git a/en-US/The_Apache_HTTP_Server.xml b/en-US/The_Apache_HTTP_Server.xml
index 7a31005..139ca52 100644
--- a/en-US/The_Apache_HTTP_Server.xml
+++ b/en-US/The_Apache_HTTP_Server.xml
@@ -3954,7 +3954,106 @@ ErrorDocument 404 /404-not_found.html</programlisting>
<para>
This will create the <systemitem
class="resource">mod_ssl</systemitem> configuration file at
<filename>/etc/httpd/conf.d/ssl.conf</filename>, which is included in the main
Apache HTTP Server configuration file by default. For the module to be loaded, restart the
<systemitem class="service">httpd</systemitem> service as described
in <xref linkend="s3-apache-running-restarting" />.
</para>
- </section>
+
+ <important>
+ <para>
+ Due to the SSL3.0 protocol vulnerability CVE-2014-3566, described in <ulink
url="https://www.us-cert.gov/ncas/alerts/TA14-290A">SSL 3.0 Protocol
Vulnerability and POODLE Attack</ulink>, it is recommended to disable <systemitem
class="protocol">SSL</systemitem> and use only <systemitem
class="protocol">TLSv1.1</systemitem> or <systemitem
class="protocol">TLSv1.2</systemitem>. Backwards compatibility can be
achieved using <systemitem class="protocol">TLSv1.0</systemitem>.
Many products have the ability to use <systemitem
class="protocol">SSLv2</systemitem> or <systemitem
class="protocol">SSLv3</systemitem> protocols, or enable them by
default. However, the use of <systemitem
class="protocol">SSLv2</systemitem> or <systemitem
class="protocol">SSLv3</systemitem> is now strongly recommended
against.
+ </para>
+ </important>
+
+ </section>
+
+ <section
id="s3-apache-Enabling_and_Disabling_SSL_and_TLS_in_mod_ssl">
+ <title>Enabling and Disabling SSL and TLS in mod_ssl</title>
+ <para>
+ To disable and enable specific versions of the SSL and TLS protocol, either do it
globally by adding the <command>SSLProtocol</command> directive in the
<quote>## SSL Global Context</quote> section of the configuration file and
removing it everywhere else, or edit the default entry under <quote># SSL Protocol
support</quote> in all <quote>VirtualHost</quote> sections. If you do
not specify it in the per-domain VirtualHost section then it will inherit the settings
from the global section. To make sure that a protocol version is being disabled the
administrator should either <emphasis role="bold">only</emphasis>
specify <command>SSLProtocol</command> in the <quote>SSL Global
Context</quote> section, or specify it in <emphasis
role="bold">all</emphasis> per-domain VirtualHost sections.
+ </para>
+<procedure id="proc-Disable_SSLv2_and_SSLv3">
+<title>Disable SSLv2 and SSLv3</title>
+<para>
+ To disable SSL version 2 and SSL version 3, which implies enabling everything except
SSL version 2 and SSL version 3, in all VirtualHost sections, proceed as follows:
+</para>
+<step>
+ <para>
+ As <systemitem class="username">root</systemitem>, open the
<filename>/etc/httpd/conf.d/ssl.conf</filename> file and search for
<emphasis role="bold">all</emphasis> instances of the
<command>SSLProtocol</command> directive. By default, the configuration file
contains one section that looks as follows:
+ <screen>~]# <command>vi /etc/httpd/conf.d/ssl.conf</command>
+# SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol all -SSLv2</screen>
+This section is within the VirtualHost section.
+ </para>
+</step>
+<step>
+ <para>
+ Edit the <command>SSLProtocol</command> line as follows:
+<screen># SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol All -SSLv2 -SSLv3</screen>
+Repeat this action for all VirtualHost sections.
+ </para>
+</step>
+<step>
+ <para>
+ Verify that all occurrences of the <command>SSLProtocol</command>
directive have been changed as follows:
+ <screen>~]# <command>grep SSLProtocol
/etc/httpd/conf.d/ssl.conf</command>
+<emphasis role="bold">SSLProtocol</emphasis> all -SSLv2
-SSLv3</screen>
+This step is particularly important if you have more than the one default VirtualHost
section.
+ </para>
+</step>
+<step>
+ <para>
+ Restart the Apache daemon as follows:
+ <screen>~]# <command>service httpd
restart</command></screen>
+ Note that any sessions will be interrupted.
+ </para>
+</step>
+
+</procedure>
+
+<procedure id="proc-Disable_All_SSL_and_TLS_Except_TLS1_and_Up">
+<title>Disable All SSL and TLS Protocols Except TLS 1 and Up</title>
+<para>
+ To disable all SSL and TLS protocol versions except TLS version 1 and higher, proceed
as follows:
+</para>
+<step>
+ <para>
+ As <systemitem class="username">root</systemitem>, open the
<filename>/etc/httpd/conf.d/ssl.conf</filename> file and search for
<emphasis role="bold">all</emphasis> instances of
<command>SSLProtocol</command> directive. By default the file contains one
section that looks as follows:
+ <screen>~]# <command>vi /etc/httpd/conf.d/ssl.conf</command>
+# SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol all -SSLv2</screen>
+ </para>
+</step>
+<step>
+ <para>
+ Edit the <command>SSLProtocol</command> line as follows:
+ <screen># SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2</screen>
+ </para>
+</step>
+<step>
+ <para>
+ Verify the change as follows:
+ <screen>~]# <command>grep SSLProtocol /etc/httpd/conf.d/ssl.conf
</command>
+<emphasis role="bold">SSLProtocol</emphasis> -All +TLSv1 +TLSv1.1
+TLSv1.2</screen>
+ </para>
+</step>
+<step>
+ <para>
+ Restart the Apache daemon as follows:
+ <screen>~]# <command>service httpd
restart</command></screen>
+ Note that any sessions will be interrupted.
+ </para>
+</step>
+
+</procedure>
+ </section>
+
<section id="s3-apache-mod_ssl-keypair">
<title>Using an Existing Key and Certificate</title>
<indexterm>