Enabling TLS 1.2 Protocol

enginaar

enginaar

Verified User
Joined
May 20, 2004
Messages
158
Location
Turkiye
Hello,

I'm trying to enable tls 1.2 protocol on my server. I've upgraded to custombuild2, apache 2.4, openSSL 1.0.2g 1 Mar 2016. I've ran
following commands but still can't seem to get it working for some reason.

Code: 
./build update 
./build rewrite_confs

/etc/httpd/conf/extra/httpd-ssl.conf is like below.

Code: 
# Disable SSLv2/3
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
# [url]https://mozilla.github.io/server-side-tls/ssl-config-generator/[/url] intermediate configuration.
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

SSL Labs still says TLS 1.2 not supported.

https://www.ssllabs.com/ssltest/analyze.html?d=afyonsucukmarket.com

I'd appreciate any help, thanks in advance.
Engin
 
Hello,

It seem you are running nginx either as a standalone server or as a reverse proxy in front of apache.
So check the nginx's settings.

By the way what is the OS version? And what you see with :

Code: 
nginx -V

and

Code: 
cat /etc/nginx/nginx-defaults.conf
?
 
Hi Alex,

Here is the nginx version
Code: 
nginx version: nginx/1.8.1

and here the ssl configuration.
Code: 
# [url]https://mozilla.github.io/server-side-tls/ssl-config-generator/[/url] intermediate configuration.
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

I'm still using Ubuntu 10.04LTS kernel version 2.6.32-74-server. I've talked to da support and turns out even though the openssl version is up to date my OS version doesn't support the protocol. They told me I need to upgrade to a new OS version which I have been postponing to do anyways.

Thanks for the help,
Engin
 
You must log in or register to reply here.
Back
Top