UNIX for Dummies Questions & Answers

Hi everyone,

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl.

I have followed the steps outlined in the documentation (see above link), especially making sure that the NSSProtocol directive reads as follows (according to the docs, this disables all SSL and TLS protocol versions except TLS version 1 and higher):

Code:

NSSProtocol TLSv1.0,TLSv1.1

Then I restarted Apache and tested whether SSLv3 is enabled:

Code:

openssl s_client -connect localhost:443 -ssl3

which returns (output has been truncated for brevity):

Code:

[root@box1 ~]# openssl s_client -connect localhost:443 -ssl3
CONNECTED(00000003)
139894684407712:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol  : SSLv3
Cipher    : 0000
Session-ID: 
Session-ID-ctx: 
Master-Key: 
Key-Arg   : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1442107224
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
---
[root@box1 ~]#

As you can see, the handshake completes (as indicated by SSL handshake has read 5 bytes and written 7 bytes) so that makes me doubt that SSLv3 has been actually disabled.

I have spent countless hours searching for a solution but everything I've been able to found tells me how to disable SSLv3 through mod_ssl, not mod_nss.

Any ideas or clarifications will be more than welcome.

I received an answer at another forum. Here's the link in case someone has the same question in the future.