Turning off SSL engine in Apache for CentOS

Turning off SSL engine in Apache is very easy and straightforward, just go to

1. Edit ssl.conf

# vim /etc/httpd/conf.d/ssl.conf

2. Find a line SSLEngine and turn it to off

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine off

3. Restart the Httpd Services

# service httpd restart

SSL/TTL strong encryption How to from Apache

I was browsing on Apache Document Website and like this How-To tutorial "SSL/TLS Strong Encryption: How-To". Previously I have blog an entry on How to disable SSLv2 and Weak Cipers and enable SSLv3 on Linux . This How-To from Apache can be easily adapted to similar settings.

Here are some excerpts from the How-To


1. Create a real SSLv2-only server?

The following creates an SSL server which speaks only the SSLv2 protocol and its ciphers.
httpd.conf

SSLProtocol -all +SSLv2
SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP

2. How can I create an SSL server which accepts strong encryption only?

The following enables only the seven strongest ciphers:
At /etc/httpd/conf/httpd.conf

SSLProtocol all
SSLCipherSuite HIGH:MEDIUM

3. Accepts All types of cipher in general, but requires strong cipher for access to particular URL.

At /etc/httpd/conf/conf.d/ssl.conf

# (liberal in general for all cipher)

SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

# But at the particular directory which require strong encryption

<Location /strong/area>
# but https://hostname/strong/area/ and below
# requires strong ciphers
SSLCipherSuite HIGH:MEDIUM
</Location>

How to disable SSLv2 and Weak Cipers and enable SSLv3 on Linux

In order to be Payment Card Industry Data Security Standard PCI-DSS) Compliance v1.2, we are required to use “use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.”

Secure Socket Layer (SSL) version 2 is considered weak cryptography in this aspect. To disabled SSLv2 and enable SSLv3. Assuming you already have OpenSSL installed, you can use another remote server to test the https connections

# openssl s_client -ssl2 -connect remote_server:443

If your server does not support SSLv2, you should receive the following error

CONNECTED(00000003)
22255:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:

If your server is enabled to supports SSLv2 connections, the connection will be accepting input

CONNECTED(00000003)

 To use SSLv3 and TLSv1, you have to modify the following at SSLCipherSuite directive in the httpd.conf or /etc/httpd/conf.d/ssl.conf file. In the example, you can do the following

#SSLProtocol all -SSLv2
SSLProtocol -all +SSLv3 +TLSv1

On my /etc/httpd/conf.d/ssl.conf

SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

For more information,see

1. How to Disable SSLv2 and Weak Ciphers(PCI Compliance (http://almamunbd.blogspot.com)
2. How to Disable SSLv2 and Weak Ciphers(PCI Compliance (http://www.srcnix.com)