Skip Navigation

Support

 

Disable SSL 2.0 in Apache

These instructions detail how to Disable SSL 2.0 (SSLv2) in Apache so that only SSL 3.0 (SSLv3) and TLS 1.0 are accepted for SSL connections.

  1. Login to the server via SSH
  2. Backup the existing apache conf file
    • cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.bak
  3. Comment out the existing references to SSLCipherSuite in the httpd.conf
    • sed -i 's/SSLCipherSuite/#SSLCipherSuite/g' /etc/httpd/conf/httpd.conf
  4. Add the following two lines to the httpd.conf
    5. SSLProtocol all -SSLv2  
    SSLCipherSuite ALL:!ADH:!NULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:+SSLv3:+TLSv1:-SSLv2:+EXP:+Enull
  5. Check the Apache configuration 
    • /etc/init.d/httpd configtest
  6. If the config test passes; restart apache.
    • /etc/init.d/httpd restart