Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
To: users@httpd.apache.org
References: <CALxjr02DCFz76E=1QcbhU7K625aZ35Hp2VG8vG_tenusVDrGDw@mail.gmail.com>
From: David Copeland <david.copeland@jsidata.ca>
Organization: JSI Data Systems Limited
Message-ID: <85050b1f-b3d1-ce7a-66ea-8535a3cb91fe@jsidata.ca>
Date: Wed, 7 Dec 2016 06:56:22 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.5.0
MIME-Version: 1.0
In-Reply-To: <CALxjr02DCFz76E=1QcbhU7K625aZ35Hp2VG8vG_tenusVDrGDw@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------13CBD0AE4DCC1E5B8BFE7669"
Subject: Re: [users@httpd] SSLCipherSuite and SSL Key Exchange
archived-at: Wed, 07 Dec 2016 11:56:36 -0000

--------------13CBD0AE4DCC1E5B8BFE7669
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Try the configuration tool at
https://mozilla.github.io/server-side-tls/ssl-config-generator/ .

Dave.

On 07/12/16 06:19 AM, Tea Wrex wrote:
> I have been using the Qualys SSL Labs SSL Server Test
> <https://www.ssllabs.com/ssltest/index.html> to test my SSL
> implementation. It scores an SSL server using the criteria located in
> the SSL Server Rating Guide
> <https://www.ssllabs.com/projects/rating-guide/index.html>. I'm trying
> to make the SSL as secure as possible. I have a 4096 bit certificate.
> My server currently gets an A+ rating because I have enabled HTTP
> Strict Transport Security (HSTS) with long duration. (More info on
> correctly configuring SSL can be found here
> <https://www.ssllabs.com/projects/documentation/index.html>.)
>
>
> What I am trying to do is get the /Key Exchange/ and /Cipher Strength/
> scores to be 100 percent. I already have a 100 percent grade for the
> /Certificate/ and/Protocol Support/ scores.
>
> I have no idea how to fix the /Key Exchange/ score, so I need help
> with that.
>
> I have been trying to change the /Cipher Strength/ score by playing
> with different variations of /SSLCipherSuite/.
>
> This is my current setting for /SSLCipherSuite/:
>
> SSLCipherSuite ECHD:!aNULL:!NULL:!eNULL:!MEDIUM:!LOW:!MD5:!RC4
>
> It says in the Apache manual under /SSLCipherSuite/ that MEDIUM is
> "all ciphers with 128 bit encryption." However, when I have set
> !MEDIUM (as shown above) it does not remove the 128bit ciphers as they
> are still listed in the test results. I have tried various settings
> but cannot seem to remove the 128 bit ciphers.I also tried -MEDIUM but
> that did not work either.
>
> Thanks in advance for any help you can give,
>
> Tea
>
>


-- 
David Copeland
JSI Data Systems Limited
613-727-9353
www.jsidata.ca


--------------13CBD0AE4DCC1E5B8BFE7669
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">Try the configuration tool at
      <a class="moz-txt-link-freetext" href="https://mozilla.github.io/server-side-tls/ssl-config-generator/">https://mozilla.github.io/server-side-tls/ssl-config-generator/</a> .<br>
      <br>
      Dave.<br>
      <br>
      On 07/12/16 06:19 AM, Tea Wrex wrote:<br>
    </div>
    <blockquote
cite="mid:CALxjr02DCFz76E=1QcbhU7K625aZ35Hp2VG8vG_tenusVDrGDw@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div>
          <div>I have been using the Qualys SSL Labs <a
              moz-do-not-send="true"
              href="https://www.ssllabs.com/ssltest/index.html"
              rel="noreferrer">SSL Server Test</a> to test my SSL
            implementation. It scores an SSL server using the criteria
            located in the <font size="2"><a moz-do-not-send="true"
                href="https://www.ssllabs.com/projects/rating-guide/index.html">SSL
                Server Rating Guide</a></font>. I'm trying to make the
            SSL as secure as possible. I have a 4096 bit certificate. My
            server currently gets an A+ rating because I have enabled
            HTTP Strict Transport Security (HSTS) with long duration.
            (More info on correctly configuring SSL can be found <a
              moz-do-not-send="true"
              href="https://www.ssllabs.com/projects/documentation/index.html">here</a>.)<br>
          </div>
          <div><br>
            <br>
          </div>
          What I am trying to do is get the <i>Key Exchange</i> and <i>Cipher
            Strength</i> scores to be 100 percent. I already have a 100
          percent grade for the <i>Certificate</i> and<i> Protocol
            Support</i> scores.<br>
          <br>
        </div>
        I have no idea how to fix the <i>Key Exchange</i> score, so I
        need help with that. <br>
        <br>
        I have been trying to change the <i>Cipher Strength</i> score
        by playing with different variations of <i>SSLCipherSuite</i>.<br>
        <div>
          <div>
            <div><br>
            </div>
            <div>This is my current setting for <i>SSLCipherSuite</i>:<br>
              <br>
            </div>
            <div>SSLCipherSuite
              ECHD:!aNULL:!NULL:!eNULL:!MEDIUM:!LOW:!MD5:!RC4<br>
              <br>
            </div>
            <div>It says in the Apache manual under <i>SSLCipherSuite</i>
              that MEDIUM is "all ciphers with 128 bit encryption."
              However, when I have set !MEDIUM (as shown above) it does
              not remove the 128bit ciphers as they are still listed in
              the test results. I have tried various settings but cannot
              seem to remove the 128 bit ciphers.I also tried -MEDIUM
              but that did not work either.<br>
            </div>
            <div><br>
            </div>
            <div>Thanks in advance for any help you can give,<br>
            </div>
            <div><br>
            </div>
            <div>Tea<br>
            </div>
            <div><br>
              <br>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
David Copeland
JSI Data Systems Limited
613-727-9353
<a class="moz-txt-link-abbreviated" href="http://www.jsidata.ca">www.jsidata.ca</a>
</pre>
  </body>
</html>

--------------13CBD0AE4DCC1E5B8BFE7669--