Sponsored Content
Top Forums UNIX for Dummies Questions & Answers Can't disable SSLv3 in Apache + mod_nss Post 302954909 by gacanepa on Saturday 12th of September 2015 09:31:34 PM
Old 09-12-2015
RedHat Can't disable SSLv3 in Apache + mod_nss

Hi everyone,

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl.

I have followed the steps outlined in the documentation (see above link), especially making sure that the NSSProtocol directive reads as follows (according to the docs, this disables all SSL and TLS protocol versions except TLS version 1 and higher):

Code:
NSSProtocol TLSv1.0,TLSv1.1

Then I restarted Apache and tested whether SSLv3 is enabled:
Code:
openssl s_client -connect localhost:443 -ssl3

which returns (output has been truncated for brevity):

Code:
[root@box1 ~]# openssl s_client -connect localhost:443 -ssl3
CONNECTED(00000003)
139894684407712:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol  : SSLv3
Cipher    : 0000
Session-ID: 
Session-ID-ctx: 
Master-Key: 
Key-Arg   : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1442107224
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
---
[root@box1 ~]#

As you can see, the handshake completes (as indicated by SSL handshake has read 5 bytes and written 7 bytes) so that makes me doubt that SSLv3 has been actually disabled.

I have spent countless hours searching for a solution but everything I've been able to found tells me how to disable SSLv3 through mod_ssl, not mod_nss.

Any ideas or clarifications will be more than welcome.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Disable X

Im sure this is somthing easy to do but i just can not figure it out where and how would i take X out of the boot for hp ux 11 i looked in the man's and nothing so maybe sombody could throw me a bone... thanks BB (8 Replies)
Discussion started by: bbutler3295
8 Replies

2. UNIX for Dummies Questions & Answers

disable su

i have this unix version "unix v/386" and i want to disable su kindly help me (2 Replies)
Discussion started by: sak900354
2 Replies

3. Solaris

How to disable SU right

Anyone know how to disable SU right for a particular user in Solaris 8 (4 Replies)
Discussion started by: civic2005
4 Replies

4. Shell Programming and Scripting

How to disable Enable/Disable Tab Key

Hi All, I have bash script, so what is sintax script in bash for Enable and Disable Tab Key. Thanks for your help.:( Thanks, Rico (1 Reply)
Discussion started by: carnegiex
1 Replies

5. Solaris

How disable alom?

hello guys.... I'm newbie in solaris server / os, anybody know how disable alom server v240. thank u (9 Replies)
Discussion started by: yanto85
9 Replies

6. Solaris

Printer always disable itself

Hi, I am using solaris 10, 1 of the printers encounter some issue and it is always disable itself and dont know why? any idea how to make it auto enable back to normal? is there any configuration or scripts?? kindly advise me. thanks. (2 Replies)
Discussion started by: freshmeat
2 Replies

7. Solaris

Problem compiling mod_nss for Apache2.2 Solaris 10

Following this guide for Solaris 9. Updated it for the nspr-4.6.4 and nss-3.11.4. Here is my configure command in the mod_nss 1.0.8 dir: ./configure --with-apxs=/usr/local/apache2/bin/apxs --with-nss=/usr/local/nss-3.11.4/ --with-nspr=/usr/local/nspr-4.6.4/ And here is the error... (2 Replies)
Discussion started by: LittleLebowski
2 Replies

8. Red Hat

SSL/TLS renegotiation DoS -how to disable? Is it advisable to disable?

Hi all Expertise, I have following issue to solve, SSL / TLS Renegotiation DoS (low) 222.225.12.13 Ease of Exploitation Moderate Port 443/tcp Family Miscellaneous Following is the problem description:------------------ Description The remote service encrypts traffic using TLS / SSL and... (2 Replies)
Discussion started by: manalisharmabe
2 Replies

9. Web Development

Apache module development on apache 2.2

Hi, I'm new to developing modules for Apache. I understand the basics now and can develop something simple which allows a 'GET' request to happen, but what I want to do is actually 'POST' information to my site. I know the basic POST Request works and I can see that it is post by looking at... (2 Replies)
Discussion started by: fishman2001
2 Replies

10. Red Hat

Process not running: /opt/java15/jdk/bin/java -classpath /opt/apache/apache-ant-1.7.0-mod/lib/ant-la

Have no idea on what the below error message is: Process not running: /opt/java15/jdk/bin/java -classpath /opt/apache/apache-ant-1.7.0-mod/lib/ant-launcher.jar org.apache.tools.ant.launch.Launcher -buildfile build.xml dist. Any help? (3 Replies)
Discussion started by: gull05
3 Replies
CURLOPT_PROXY_SSL_CIPHER_LIST(3)			     curl_easy_setopt options				  CURLOPT_PROXY_SSL_CIPHER_LIST(3)

NAME
CURLOPT_PROXY_SSL_CIPHER_LIST - specify ciphers to use for proxy TLS SYNOPSIS
#include <curl/curl.h> CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_CIPHER_LIST, char *list); DESCRIPTION
Pass a char *, pointing to a zero terminated string holding the list of ciphers to use for the connection to the HTTPS proxy. The list must be syntactically correct, it consists of one or more cipher strings separated by colons. Commas or spaces are also acceptable separators but colons are normally used, !, - and + can be used as operators. For OpenSSL and GnuTLS valid examples of cipher lists include 'RC4-SHA', 'SHA1+DES', 'TLSv1' and 'DEFAULT'. The default list is normally set when you compile OpenSSL. You'll find more details about cipher lists on this URL: https://www.openssl.org/docs/apps/ciphers.html For NSS, valid examples of cipher lists include 'rsa_rc4_128_md5', 'rsa_aes_128_sha', etc. With NSS you don't add/remove ciphers. If one uses this option then all known ciphers are disabled and only those passed in are enabled. You'll find more details about the NSS cipher lists on this URL: http://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html#Directives The application does not have to keep the string around after setting this option. DEFAULT
NULL, use internal default PROTOCOLS
All EXAMPLE
TODO AVAILABILITY
Added in 7.52.0 If built TLS enabled. RETURN VALUE
Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or CURLE_OUT_OF_MEMORY if there was insufficient heap space. SEE ALSO
CURLOPT_PROXY_SSLVERSION(3), CURLOPT_USE_SSL(3), CURLOPT_SSLVERSION(3), libcurl 7.54.0 December 21, 2016 CURLOPT_PROXY_SSL_CIPHER_LIST(3)
All times are GMT -4. The time now is 02:09 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy