2

I'm attempting to disable SSLv3 in Apache which I've installed on Windows via xampp. But I'm having trouble figuring out how. I was told that I needed to add

SSLProtocol All -SSLv2 -SSLv3

To my ssl config file but I'm not sure where that is.

I see a

C:\xampp\apache\conf\extra\httpd-ssl.conf

but from the research I've done heard that I'm looking for a ssl.conf file which doesn't seem to exist.

Any ideas?

Edit also, from the tutorials I was reading, I'm still not sure where in the config file I'd place the SSLProtocol All -SSLv2 -SSLv3 if I was able to find the config file.

Matt
  • 896
  • 5
  • 18
  • 47
  • just stuff it somewhere. .conf files are occasionally broken out into multiple separate files for convenience/grouping of configurations, but the lack of a file doesn't mean anything. Without a .conf file, apache will just use its compile-time defaults. – Marc B Oct 27 '14 at 14:02
  • Marc B where should I place the file? And how do I know apache will use it? – Matt Oct 27 '14 at 14:05
  • just put it at the end of the main httpd.conf or whatever. – Marc B Oct 27 '14 at 14:05
  • Awesome it worked! Thanks, if you want you can go ahead and put your comment as an answer and I can label it the correct answer. – Matt Oct 27 '14 at 14:18

1 Answers1

14

Had to figure this out myself and too like 30 minutes of Googling to figure it out. Just thought I'd answer it and leave this here for anyone else who comes by and looks at it.

xampp > apache > conf > extra > httpd-ssl.conf

Just add

SSLProtocol All -SSLv2 -SSLv3

right below

Listen 443

and then save and restart. Afterwards, goto http://poodlebleed.com/ and enter your domain and port to make sure that you are now good.

Hope this helps!

Logan
  • 156
  • 1
  • 2