ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    CentOS7 Server Apache Disable old TLS for higher versions

    IT Discussion
    tls tls 1.2 tls 1.0 apache httpd
    4
    12
    2.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DustinB3403D
      DustinB3403
      last edited by

      So the question has just come to me, how can I disable TLS v1 and force higher versions of TLS running on a CentOS 7 VM running an apache website.

      I often don't bother with public facing things and thus never really look into this. So I'm looking for guidance / confirmation.

      This appears to be the answer and than just wait a bit so the Interwebz can realize this change has been made.

      Any additional guidance?

      JaredBuschJ 1 Reply Last reply Reply Quote 3
      • A
        Alex Sage
        last edited by

        So to be clear you want to disable TLS v1.0 and allow everything from TLS 1.1 up?

        A DustinB3403D 2 Replies Last reply Reply Quote 0
        • A
          Alex Sage @Alex Sage
          last edited by Alex Sage

          Seems like you should disable everything except TLS 1.2 unless you need to support something that doesn't support 1.2 TLS

          0_1538506991940_c4ebcf7a-bfd6-43ec-a7d9-74b7fdadf6dc-image.png

          https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-hardening_tls_configuration

          Could you put Cloudflare or nginx in front of this?

          DustinB3403D 1 Reply Last reply Reply Quote 0
          • DustinB3403D
            DustinB3403 @Alex Sage
            last edited by

            @aaronstuder said in CentOS7 Server Apache Disable old TLS for higher versions:

            So to be clear you want to disable TLS v1.0 and allow everything from TLS 1.1 up?

            Yea

            1 Reply Last reply Reply Quote 0
            • DustinB3403D
              DustinB3403 @Alex Sage
              last edited by DustinB3403

              @aaronstuder said in CentOS7 Server Apache Disable old TLS for higher versions:

              Could you put Cloudflare or nginx in front of this?

              No, this isn't hosted in a manner in which this wouldn't be viable. (read as outside of my control).

              A 1 Reply Last reply Reply Quote 0
              • A
                Alex Sage @DustinB3403
                last edited by

                @dustinb3403 Got ya, that's why I asked 😉

                1 Reply Last reply Reply Quote 0
                • A
                  Alex Sage
                  last edited by

                  This looks OK, but I haven't tested it.

                  https://www.cloudibee.com/disabling-tls-apache/

                  I would check it with SSL Labs after you disable it.

                  https://www.ssllabs.com/

                  1 Reply Last reply Reply Quote 1
                  • JaredBuschJ
                    JaredBusch @DustinB3403
                    last edited by

                    @dustinb3403 said in CentOS7 Server Apache Disable old TLS for higher versions:

                    So the question has just come to me, how can I disable TLS v1 and force higher versions of TLS running on a CentOS 7 VM running an apache website.

                    I often don't bother with public facing things and thus never really look into this. So I'm looking for guidance / confirmation.

                    This appears to be the answer and than just wait a bit so the Interwebz can realize this change has been made.

                    Any additional guidance?

                    Yes, for Apache, that is pretty much it. You update your SSLProtocol as needed and restart the service.

                    1 Reply Last reply Reply Quote 2
                    • coliverC
                      coliver
                      last edited by

                      @DustinB3403 I really like this site for information on securing various web servers.

                      https://cipherli.st/

                      JaredBuschJ 1 Reply Last reply Reply Quote 0
                      • JaredBuschJ
                        JaredBusch @coliver
                        last edited by

                        @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                        @DustinB3403 I really like this site for information on securing various web servers.

                        https://cipherli.st/

                        I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                        https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                        coliverC 1 Reply Last reply Reply Quote 0
                        • coliverC
                          coliver @JaredBusch
                          last edited by

                          @jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

                          @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                          @DustinB3403 I really like this site for information on securing various web servers.

                          https://cipherli.st/

                          I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                          https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                          First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

                          JaredBuschJ 1 Reply Last reply Reply Quote 0
                          • JaredBuschJ
                            JaredBusch @coliver
                            last edited by

                            @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                            @jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

                            @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                            @DustinB3403 I really like this site for information on securing various web servers.

                            https://cipherli.st/

                            I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                            https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                            First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

                            Correct. That is the only change I made to their config. I even reran dhparam

                            1 Reply Last reply Reply Quote 0
                            • 1 / 1
                            • First post
                              Last post