#mod-ssl

How-to: How can I configure Apache to use HTTPS for external access but HTTP for internal access? #dev #computers #solution

How can I configure Apache to use HTTPS for external access but HTTP for internal access?

I have two servers, one a development server that is accessible internally on our company’s local network and the other a public-facing web server. The development server hosts several tools that we use to manage our projects internally but now we need to access them externally too whilst maintaining…

Fixed: How to disable TLS 1.1 & 1.2 in Apache? #development #programming #computers

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1.

In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line with -all +SSLv3.

With that configuration, TLS 1.1 & 1.2 are enabled and work correctly – which is counter-intuitive to me, as I would expect that onlySSLv3…

How-to: How to Disable SSLv2 for Apache httpd #solution #development #dev

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites.

How can I disable that? I tried the following but it isn’t working.

Went to /etc/httpd/conf.d/ssl.conf by ftp. Added

SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT

Connect…

Answer: How to Disable SSLv2 for Apache httpd #fix #computers #dev

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites.

How can I disable that? I tried the following but it isn’t working.

Went to /etc/httpd/conf.d/ssl.conf by ftp. Added

SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT

Connect…

How to: How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST) #programming #solution #computers

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by disabling SSL Compression, which was added to Apache 2.2.22 (See Bug 53219).

I am running Scientific Linux 6.3, which ships…

How to: How to enable TLS 1.1 and 1.2 with OpenSSL and Apache #solution #it #dev

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and Apache to ensure that we will not be vulnerable to such threat vectors.

Answer [by Steve-o]: How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

Y…

Resolved: How to enable TLS 1.1 and 1.2 with OpenSSL and Apache #fix #answer #it

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and Apache to ensure that we will not be vulnerable to such threat vectors.

Answer [by Steve-o]: How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

Y…

Solution: ssl_error_rx_record_too_long and Apache SSL #answer #dev #solution

ssl_error_rx_record_too_long and Apache SSL

I’ve got a customer trying to access one of my sites, and they keep getting this error > ssl_error_rx_record_too_long

They’re getting this error on all browsers, all platforms. I can’t reproduce the problem at all.

My server and myself are located in the USA, the customer is located in India.

I googled on the problem, and the main source seems to be…