5

I am trying to specify SSLCipherSuite in my .htaccess file, but the changes don't seem to take effect. I am running on a shared hosting account, so only have access to .htaccess, and not server/virtual host config files. The Apache documentation says this directive works under .htaccess context. My server is running Apache 2.2. Here is my complete .htaccess file:

RewriteEngine on
ErrorDocument 404 /404.html

# map index.html to root dir
RewriteCond %{HTTP_HOST} ^automsw\.com$ [OR,NC]
RewriteCond %{HTTP_HOST} ^www\.automsw\.com$ [NC]
RewriteRule ^index\.html$ "https\:\/\/www\.automsw\.com\/" [R=301,L]

# map index.html in sub-directories to that directory
RewriteCond %{HTTP_HOST} ^automsw\.com$ [OR,NC]
RewriteCond %{HTTP_HOST} ^www\.automsw\.com$ [NC]
RewriteRule ^(.*)/index\.html$ "https\:\/\/www\.automsw\.com\/$1/" [R=301,L]

# map non-www to www and http to https
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^automsw.com$ [NC]
RewriteRule ^(.*)$ "https\:\/\/www\.automsw\.com\/$1" [R=301,L]

#SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA 3DES RC4 !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS +3DES 3DES +RC4 RC4"
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT

I've tried several different SSLCipherSuite values, and none change the results as determined by a server test at:

https://www.ssllabs.com/ssltest/analyze.html?d=automsw.com

Is this possible, or am I doing something wrong?

Thanks in advance.

Mark
  • 440
  • 4
  • 16
  • I think the problem may be that I don't have AuthConfig permissions on my shared hosting account for my virtual domain... All the Rewrite stuff works in my .htaccess file, so I must have FileInfo, but apparently not AuthConfig. – Mark Sep 05 '14 at 03:33

1 Answers1

0

At a bit of a guess - it's probable that this can't be set in .htacesss because of the way a Server-Client Handshake happens. You can't connect to Apache and complete the TLS handshake, and then negotiate ciphers in the htaccess file.

Remember that connections hit Apache first and only after rules are applied there does .htaccess get parsed.

sauj
  • 148
  • 1
  • 7