Linux – Disabling anonymous ciphers in Apache not working

apache-2.2linuxopensslSecurityssl

We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever. 

SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite CDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS

However, I'm still failing the SslLabs scan with the following message:

This server supports anonymous (insecure) suites

Why is it still failing if I'm only using strong ciphers and can't find any overriding configuration anywhere?

Best Answer

openssl ciphers -v with the cipher string will show the list.

You don't disable null encryption with !eNULL. OpenSSL does not enable it even in ALL but might as well make turning it off explicit.

Check for any config files containing SSL. And confirm it is httpd listening on that port.

You can get a second opinion with a local SSL/TLS scan script. There are a couple good ones that show exactly which ciphers they use.

Strong ciphers is relative. OpenSSL 0.9.8 can't really do TLS 1.1 or 1.2 so it isn't going to provide modern security (or score well in SSLLabs).

Related Topic