Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of covener@gmail.com designates
 209.85.217.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAFMGiz9jiwjpXem4jPsXEWBmDUKi-GQ7xa-7J1WAZgG0tQ2Mww@mail.gmail.com>
References: 
 <CAFMGiz9jiwjpXem4jPsXEWBmDUKi-GQ7xa-7J1WAZgG0tQ2Mww@mail.gmail.com>
Date: Tue, 7 Aug 2012 08:46:42 -0400
Message-ID: 
 <CALK=YjO3K5e3PzM_WZNEq-g4McTLfU5gtp=wCrFj6KP0XfCnOQ@mail.gmail.com>
From: Eric Covener <covener@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [users@httpd] Two SSL directives appear to be not working with
 SSL Labs server test

On Tue, Aug 7, 2012 at 8:14 AM, Tom Browder <tom.browder@gmail.com> wrote:
> I have been checking my Apache 2.2.14 server with this link:
>
>   https://www.ssllabs.com/ssltest/index.html
>
> I am trying to improve my SSL Labs security score but can't beat 85.
> I am running Apache 2.2.14 (from Ubuntu's package).
>
> I get the following scores:
>
>   Certificate              100
>   Protocol support       85
>   Key exchange          80
>   Cipher exchange      90
>
> The test report shows:
>
>   This server is vulnerable to the BEAST attack.
>   Certificate Key RSA/4096 bits
>   Cipher Suites (sorted by strength; server has no preference)

I'm not sure how the tool can make that determination. SSLv3-and-later
allows the server to pick any cipher out of the intersection of what's
supported by both ends

>     TLS_RSA_WITH_RC4_128_MD5 (0x4)      128
>     TLS_RSA_WITH_RC4_128_SHA (0x5)      128
>     TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
>     TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 1024 bits (p: 128, g:
> 1, Ys: 128)     128
>     TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 168
>     TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16)   DH 1024 bits (p: 128,
> g: 1, Ys: 128)  168
>     TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
>     TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 1024 bits (p: 128, g:
> 1, Ys: 128)     256
>
> I have the following in my server block:
>
>   SSLProtocol all -SSLv2
>   SSLHonorCipherOrder On
>   # disallow DH ciphers
>   SSLCipherSuite HIGH:RC4:+HIGH+TLSv1:!aNULL:!MD5:!DH:!EDH:!ADH
>
> It looks like the "SSLHonorCipherOrder On" and "SSLCipherSuite"
> directives aren't working according to the test report.

What does the following report on your system?

  openssl ciphers 'HIGH:RC4:+HIGH+TLSv1:!aNULL:!MD5:!DH:!EDH:!ADH'

When i run it on different systems, RC4 may or may not be preferred.
I'm not terribly familiar with the syntax, but it doesnt look as if
that string takes great lengths to prefer or require RC4 to mitigate
the BEAST issue.

Although I also now notice you disabled MD5 but the scan reported
rc4-md5. Are you sure it scanned your actual system and you're in the
right vhost?

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org