0

I am not entirely sure whether I am at the right place here or not, but I hope one of you can help me with this: I want to make certain restricions to the TLS CipherSuits that are used by Apache on my Ubuntu server. I do not want the HMAC to be SHA1 but something different, like SHA256 or stronger. I assumed it has to be set in the /etc/apache2/mods-available/ssl.conf in the line with the SSLCiphersuite, but it does not work. I tried this line:

SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA:EECDH:EDH+AESGCM:EDH:+3DES:ECDH+AESGCM:ECDH+AES:ECDH:AES:HIGH:MEDIUM:!RC4:!SHA1:!SHA:!HMAC-SHA1:!CAMELLIA:!SEED:!aNULL:!MD5:!eNULL:!LOW:!EXP:!DSS:!PSK:!SRP

and this as well (a bit shorter)

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

But even after arestart, my Webserer still uses HMAC SHA1. I have also installed Plesk on it, in case this could have an impact.

Can anybody help me on this point?

BR John

Improve this question
2
  • Hmm... shouldn't you be modifying the config of sites-enabled instead of sites-available?
    – Eduardo López
    Feb 3, 2016 at 22:59
  • As far as I know all files in mods-enabled are pointing towars the config files in mods-available. Just like this: ssl.load -> ../mods-available/ssl.load
    – JRsz
    Feb 4, 2016 at 11:45

1 Answer 1

Reset to default
0

I solved the issue by myself. The trick is to change the ciphersuits in /etc/nginx/ssl.conf to whatever you like. Note that this config file requires a ; at the end of each line. I think this is because of the way Plesk manages all services.

Maybe this helps anybody with simillar problems.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .