0

I’ve been asked to disable SSL v3 and TLS v1 on our web servers.

But Apache reports:

[error] No SSL protocols available [hint: SSLProtocol]

when I include –TLSv1 in the SSLProtocol stanza below.

If I remove –TLSv1 it works fine but TLS version 1 is of course then enabled.

AFAIK ‘All’ means +SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 in OpenSSL v 1.0.1, which is the version I am using.

So why does it reject –TLSv1?

SSLProtocol All –TLSv1 -SSLv2 -SSLv3

SSLHonorCipherOrder on

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
dawud
  • 15,096
  • 3
  • 42
  • 61
Shaun McCullagh
  • 1
  • 1
  • 2
  • 2
    Are you sure you want to disable TLSv1? That will kill connectivity for a large percentage of users, and it is not appropriate for a public web site. – Michael Hampton Nov 20 '14 at 17:18
  • 1
    Which version of Apache/mod_ssl you are running? Are you sure that your version of apache even knows about TLSv1.1 and TLSv1.2? Try to disabling these protocols, if it complains your apache version is too old for what you want to do. – Steffen Ullrich Nov 22 '14 at 08:36

1 Answers1

1

It's a little bit old but if this can help someone... Here we go!

It is more related to the first "-" character codification, it is not a standard UTF-8 Minus sign, and Apache does it not recognizes it. 

SSLProtocol All **–**TLSv1 -SSLv2 -SSLv3

This is the error I get in my server:

Syntax error on line 162 of /etc/httpd/vhosts.d/test.conf:
SSLProtocol: Illegal protocol '\xe2\x80\x93TLSv1'

Just remove it and write a Minus sign manually, without pasting it from another source. This worked for me.

Thanks and best regards!

Nixphoe
  • 4,584
  • 7
  • 34
  • 52