0

I need to unsupport TLSv1 and RC4-SHA

So i have this lines in my ssl.conf

SSLProtocol +TLSv1.2 +TLSv1.1 -TLSv1
SSLCompression off
SSLHonorCipherOrder on
SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA"

And I am checking if RC4 and TLSv1 are still supported using this command

sslscan --no-failed xxx.xxx.xxx.xxx:1337

sslscan gave me this result:

 Supported Server Cipher(s):
    Accepted  TLSv1  256 bits  AES256-SHA
    Accepted  TLSv1  256 bits  CAMELLIA256-SHA
    Accepted  TLSv1  128 bits  AES128-SHA
    Accepted  TLSv1  128 bits  CAMELLIA128-SHA
    Accepted  TLSv1  128 bits  DES-CBC3-SHA
    **Accepted  TLSv1  128 bits  RC4-SHA**
    Accepted  TLS11  256 bits  AES256-SHA
    Accepted  TLS11  256 bits  CAMELLIA256-SHA
    Accepted  TLS11  128 bits  AES128-SHA
    Accepted  TLS11  128 bits  CAMELLIA128-SHA
    Accepted  TLS11  128 bits  DES-CBC3-SHA
    **Accepted  TLS11  128 bits  RC4-SHA**
    Accepted  TLS12  256 bits  AES256-GCM-SHA384
    Accepted  TLS12  256 bits  AES256-SHA256
    Accepted  TLS12  256 bits  AES256-SHA
    Accepted  TLS12  256 bits  CAMELLIA256-SHA
    Accepted  TLS12  128 bits  AES128-GCM-SHA256
    Accepted  TLS12  128 bits  AES128-SHA256
    Accepted  TLS12  128 bits  AES128-SHA
    Accepted  TLS12  128 bits  CAMELLIA128-SHA
    Accepted  TLS12  128 bits  DES-CBC3-SHA
    **Accepted  TLS12  128 bits  RC4-SHA**

Apparently RC4-SHA is still accepted which I am trying to configure to not support any RC4 and TLSv1. Is there a way of resolving this.

Thanks

jww
  • 97,681
  • 90
  • 411
  • 885
EMP
  • 87
  • 2
  • 11
  • 1
    Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Unix & Linux Stack Exchange](http://unix.stackexchange.com/) would be a better place to ask. Also see [Where do I post questions about Dev Ops?](http://meta.stackexchange.com/q/134306). – jww May 27 '16 at 21:04
  • Try `SSLProtocol` of ***`-all +TLSv1.2 +TLSv1.1`***. Try `SSLCipherSuite` of ***`HIGH:!aNULL:!RC4:!MD5`***. – jww May 27 '16 at 21:05
  • Thanks. I will try this. – EMP May 28 '16 at 18:29
  • I tired your advice but still RC4-SHA and TLSv1 are still accepted. – EMP Jun 01 '16 at 10:32

0 Answers0