innstory

Weak SSL Cipher在Apache中禁用過時的SSL ／ TLS版本

使用vi（或vim）編輯ssl.conf (通常位於/etc/httpd/conf.d/底下)

查詢SSL Protocol support

# SSL Protocol support:

# List the enable protocol levels with which clients will be able to

# connect. Disable SSLv2 access by default:

SSLProtocol all -SSLv2 -SSLv3

註解掉SSLProtocol all -SSLv2 -SSLv3

添加

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

往下拉底下SSL Cipher Suite部分也一併處理

# SSL Cipher Suite:

# List the ciphers that the client is permitted to negotiate.

# See the mod_ssl documentation for a complete list.

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

註解掉SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
添加

SSLCipherSuite HIGH:!aNULL:!MD5:!3DES

SSLHonorCipherOrder on

最後~保存文件並重新啟動Apache

以上紀錄