ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    CentOS7 Server Apache Disable old TLS for higher versions

    IT Discussion
    tls tls 1.2 tls 1.0 apache httpd
    4
    12
    2.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Alex Sage
      last edited by

      So to be clear you want to disable TLS v1.0 and allow everything from TLS 1.1 up?

      A DustinB3403D 2 Replies Last reply Reply Quote 0
      • A
        Alex Sage @Alex Sage
        last edited by Alex Sage

        Seems like you should disable everything except TLS 1.2 unless you need to support something that doesn't support 1.2 TLS

        0_1538506991940_c4ebcf7a-bfd6-43ec-a7d9-74b7fdadf6dc-image.png

        https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-hardening_tls_configuration

        Could you put Cloudflare or nginx in front of this?

        DustinB3403D 1 Reply Last reply Reply Quote 0
        • DustinB3403D
          DustinB3403 @Alex Sage
          last edited by

          @aaronstuder said in CentOS7 Server Apache Disable old TLS for higher versions:

          So to be clear you want to disable TLS v1.0 and allow everything from TLS 1.1 up?

          Yea

          1 Reply Last reply Reply Quote 0
          • DustinB3403D
            DustinB3403 @Alex Sage
            last edited by DustinB3403

            @aaronstuder said in CentOS7 Server Apache Disable old TLS for higher versions:

            Could you put Cloudflare or nginx in front of this?

            No, this isn't hosted in a manner in which this wouldn't be viable. (read as outside of my control).

            A 1 Reply Last reply Reply Quote 0
            • A
              Alex Sage @DustinB3403
              last edited by

              @dustinb3403 Got ya, that's why I asked 😉

              1 Reply Last reply Reply Quote 0
              • A
                Alex Sage
                last edited by

                This looks OK, but I haven't tested it.

                https://www.cloudibee.com/disabling-tls-apache/

                I would check it with SSL Labs after you disable it.

                https://www.ssllabs.com/

                1 Reply Last reply Reply Quote 1
                • JaredBuschJ
                  JaredBusch @DustinB3403
                  last edited by

                  @dustinb3403 said in CentOS7 Server Apache Disable old TLS for higher versions:

                  So the question has just come to me, how can I disable TLS v1 and force higher versions of TLS running on a CentOS 7 VM running an apache website.

                  I often don't bother with public facing things and thus never really look into this. So I'm looking for guidance / confirmation.

                  This appears to be the answer and than just wait a bit so the Interwebz can realize this change has been made.

                  Any additional guidance?

                  Yes, for Apache, that is pretty much it. You update your SSLProtocol as needed and restart the service.

                  1 Reply Last reply Reply Quote 2
                  • coliverC
                    coliver
                    last edited by

                    @DustinB3403 I really like this site for information on securing various web servers.

                    https://cipherli.st/

                    JaredBuschJ 1 Reply Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @coliver
                      last edited by

                      @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                      @DustinB3403 I really like this site for information on securing various web servers.

                      https://cipherli.st/

                      I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                      https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                      coliverC 1 Reply Last reply Reply Quote 0
                      • coliverC
                        coliver @JaredBusch
                        last edited by

                        @jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

                        @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                        @DustinB3403 I really like this site for information on securing various web servers.

                        https://cipherli.st/

                        I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                        https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                        First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

                        JaredBuschJ 1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch @coliver
                          last edited by

                          @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                          @jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

                          @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                          @DustinB3403 I really like this site for information on securing various web servers.

                          https://cipherli.st/

                          I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                          https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                          First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

                          Correct. That is the only change I made to their config. I even reran dhparam

                          1 Reply Last reply Reply Quote 0
                          • 1 / 1
                          • First post
                            Last post