2

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1).

here explain how to do so, but I have the following problems:

When try to use:

SSLProtocol all -SSLv2 -SSLv3 -TLSv1

I got the following error:

[error] No SSL protocols available [hint: SSLProtocol]

when try to use:

SSLProtocol TLSv1.1 TLSv1.2

I got the following error:

[error] No SSL protocols available [hint: SSLProtocol]

Th funny thing is that when I use:

SSLProtocol all -SSLv2 -TLSv1

apache don't complain and this test reported that my server not support SSLv2 and TLSv1.0, but yes SSLv3, TLSv1.1 and TLSv1.2.

Any explanation to that odd behavior? maybe the test tool is broken?

How can I enable just TLSv1.1 and TLSv1.2?

2
  • I believe you have mod_ssl activated, right?
    – Braiam
    Oct 4, 2013 at 13:15
  • Yes, the last example works, apache don't complain and...
    – user58366
    Oct 4, 2013 at 13:39

2 Answers 2

1

Setting SSLCipherSuite with just ciphers that are just supported in TLSv1.2 bypass the Apache 2.2 limitation of parse TLSv1.1 string to limited TLS to version over 1.0.

0

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

You might not be able to enable them. The Ubuntu Security team disables TLS 1.2. I believe they disabled TLS 1.1 in the past. They do it for interoperability reasons.

I believe you have three choices.

First, do nothing and use Ubuntu 12's version of OpenSSL. I believe TLS 1.1 is now supported, but you still won't have TLS 1.2.

Second, build and maintain your own PPA. There are some instructions for doing so at Override Distro Package with Custom Package? For completeness, there are no existing Personal Package Archives for Ubuntu and OpenSSL that offer the full protocols.

Third is upgrade to a later version of Ubuntu, like Ubuntu 14. I'm trying to determine if Ubuntu 14 enables them all at the moment. See Ubuntu 14, OpenSSL, and TLS Protocols?.

You must log in to answer this question.