Help needed with SSLProtocols and ciphers on Apache 2.2

Hi,

I could really do with some help/advice in resolving SSL protocol issues we are experiencing. We're running Centos 6 recently upgraded from 6.5 to 6.7 via yum update. Apache version is 2.2.15 and after setting the following in ssl.conf we are still failing to get an A rating at SSLLabs and keep getting warnings about weak ciphers.

This is what we've specified in ssl.conf (outside the virtual host):

SSLProtocol -ALL +TLSv1.1 +TLSv1.2
SSLHonorCipherOrder on
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES
128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128
-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DH
E-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

Code (ApacheConf):

The same is also set in httpd.conf

(After reading extensively various references on the matter I decided to use the cipher list from the mozilla SSL/TLS Wiki. )

The first question is why TLS1.0 is still showing as enabled in the SSLLabs scan if we have the directive as above.

Now I've read that some of these ciphers are not supported in Apache versions prior to version 2.4 and so this is where I also have a second question. If these ciphers are not supported in Apache version 2.2.15 how do we work around this in order to get the A rating at SSL Labs? As you can see in the attached scan results we are getting several warnings about weak ciphers. How do should we resolve this? Would any of the mod_ssl changelog improvements have been backported?

I'm not an expert and am finding the combination of so many factors somewhat overwhelming in terms of how best to arrive at our objective.

I'd be very grateful for any help and advice .

Thanks in advance.

 

Short answer: update Apache.

 

Thanks for your reply. It seems that there are in fact updates which have been backported which address the security fixes available in the later versions of Apache:

# rpm -q --changelog httpd | less

* Mon Aug 24 2015 Johnny Hughes <johnny@centos.org> - 2.2.15-47
- Roll in CentOS Branding

* Tue Aug 18 2015 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-47
- fix regressions caused by fix for CVE-2015-3183

* Mon Aug 10 2015 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-46
- core: fix chunk header parsing defect (CVE-2015-3183)

* Tue Mar 03 2015 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-45
- mod_proxy_balancer: add support for "drain mode" (N) (#767130)

* Fri Jan 23 2015 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-44
- set SSLCipherSuite to DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES (#1086771)

* Fri Jan 23 2015 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-43
- revert DirectoryMatch patch from 2.2.15-40 (#1016963)

* Fri Dec 19 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-42
- core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)

* Wed Dec 17 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-41
- fix compilation with older OpenSSL caused by misspelling in patch (#1162268)

* Tue Dec 02 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-40
- mod_proxy: do not mix workers shared memory during graceful restart (#1149906)
- mod_ssl: Fix SSL_CLIENT_VERIFY value when optional_no_ca and SSLSessionCache
  are used and SSL session is resumed (#1149703)
- mod_ssl: log revoked certificates at the INFO level (#1161328)
- mod_ssl: use -extensions v3_req for certificate generation (#906476)
- core: check the config file before restarting the server (#1146194)
- core: do not match files when using DirectoryMatch (#1016963)
- core: improve error message for inaccessible DocumentRoot (#987590)
- rotatelogs: improve support for localtime (#922844)
- mod_deflate: fix decompression of files larger than 4GB (#1057695)
- ab: fix integer overflow when printing stats with lot of requests (#1092419)
- ab: try all addresses instead of failing on first one when not available (#1125269)
- ab: fix read failure when targeting SSL server (#1045477)
- apachectl: support HTTPD_LANG variable from /etc/sysconfig/httpd (#963146)
- do not display "bomb" icon for files ending with "core" (#1069625)

* Tue Aug 05 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-39
- mod_proxy: close client connection if the backend closes connection (#1111410)

* Thu Jul 17 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-38
- mod_cgid: add security fix for CVE-2014-0231
- mod_deflate: add security fix for CVE-2014-0118
- mod_status: add security fix for CVE-2014-0226

* Fri Jun 27 2014 Joe Orton <jorton@redhat.com> - 2.2.15-37
- mod_ssl: fix SSLCipherSuite (#1035818)

* Mon Jun 23 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-36
- mod_ssl: Add a wildcard common name match (#1035666)
- mod_cache: avoid thundering herd (#1094990)
- mod_cgi: return error code 408 on timeout (#979129)

* Mon Jun 23 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-35
- mod_proxy_http: cleanup bucket brigade even on error (#991556)
- add missing Reason-Phrase in HTTP response headers (#1032733)
- mod_ldap: fix crash in uldap_cache_getattrvals (#1048757)

* Fri Jun 20 2014 Joe Orton <jorton@redhat.com> - 2.2.15-34
- mod_ssl: prevent use of AECDH (#1035818)

* Fri Jun 20 2014 Joe Orton <jorton@redhat.com> - 2.2.15-33
- mod_ssl: use 2048-bit RSA key with SHA-256 signature in dummy certificate (#1103115)

* Thu Jun 19 2014 Joe Orton <jorton@redhat.com> - 2.2.15-32
- mod_ssl: adjust DH temp key selection, prefer larger and up to 8192-bit. (#1071883)

* Tue Jun 10 2014 Jan Kaluza <jkaluza@redhat.com> - 2.2.15-31
- mod_proxy: fix bybusyness algorithm to balance the load after failed worker
  has recovered (#972949)
- mod_proxy: ignore EINTR when polling in proxy_connect (#976644)

Code (markup):

Would is still be necessary to upgrade Apache in order to resolve the SSL protocol and ciphers issues? As In understand it could result in incompatibilities. I'm just wondering whether I've missed something somewhere with the existing installation which is preventing us from getting the A rating (without having to upgrade Apache further).

 

Ah, right, you're running CentOS. The distro notoriously known for being SLOW about updating their core packages. Current stable release of Apache is 2.4.17 - you're running the legacy version, and that is really not recommended.
I'm not familiar enough with the SSL-vulnerabilities and the different ways to avoid them on older apache to answer your question about further updating, unfortunately. I would assume that the latest version of Apache will solve the issue, but then again, most of these testing-sites are at best semi-working, so it might be that it would still report errors. No way of knowing, really.

 

OK. Thanks for your help. I'll try back at the Centos forum to see if anyone there can help.

 

Hello,

I use this and I have A+ rating on my site.

CentOS 6.7
Apache 2.4 (Also works on 2.2)

SSLProtocol   -All +TLSv1.1 +TLSv1.2
SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off

SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK"
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off

Code (ApacheConf):

Please let me know if that works.