3

Recently I upgraded my server from Ubuntu Server 12.04 to Ubuntu Server 14.04 by means of a new installation from scratch.

Only one problem remains. In 12.04 Apache 2.2 with mod_ssl supported TLS version 1, 1.1 and 1.2. After upgrading to 14.04 and Apache 2.4, Apache only supports TLS version 1, support for 1.1 and 1.2 is missing.

I followed both the migration guide for 2.2 -> 2.4 (no changes to the mod_ssl settings) as well as the documentation of mod_ssl regarding the SSLProtocol configuration option.

Both

SSLProtocol TLSv1.2 TLSv1.1 TLSv1

and

SSLProtocol TLSv1.2

do not work. Is there any way to convince Apache to support the new TLS versions as well?

Problem seems to be solved now without any change from my side. Apparently libssl was initially compiled without TLSv1.1/TLSv1.2 support.

  • Can you describe the problem you are having / any error messages and post your config files please. Could be anything from a server problem to a browser problem. – Panther Jun 5 '14 at 15:15
  • The problem is written above, TLSv1.1 and TLSv1.2 support is missing. Apache just provides TLSv1 connections. Tested with Chronium browser and SSL Labs test(ssllabs.com/ssltest/index.html) – Jan Henke Jun 5 '14 at 15:46
  • 2
    Mod ssl supports TLS 1.x - httpd.apache.org/docs/current/mod/mod_ssl.html "This module provides SSL v3 and TLS v1.x support for the Apache HTTP Server. SSL v2 is no longer supported." It may well be a chromium bug, see code.google.com/p/chromium/issues/detail?id=90392 . Can you try an alternate browser. Test your browser howsmyssl.com – Panther Jun 5 '14 at 16:07
  • I know mod_ssl supports TLSv1.2, that is why I opened this question in the first place. For some arcane reasons the support of TLSv1.2 does not work with the binaries supplied by Ubuntu. That is the question here. Client problems are ruled out. – Jan Henke Jun 5 '14 at 16:11
  • 1
    I've always found Mozilla's TLS docs to be the best reference when setting this up and I see they use SSLProtocol all -SSLv2 which differs from your config. Also, when visiting your site I get what looks like a 'self-signed' cert so I don't think you can conduct a 3rd party test with? Possible I guess but I would expect them to reject your cert immediately. – Tom Brossman Jun 5 '14 at 16:22
1

Problem fixed itself by now without any configuration change. Apparently libssl in 14.04 was initially compiled without TLSv1.1/TLSv1.2 support and that has been fixed by now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.