Ssl – In response to the OpenSSL Poodle vulnerability should I disable SSLv3

opensslsslvulnerabilities

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt

The workaround is to disable SSLv3.

  • Will this disable HTTPS on our website completely?
  • What clients rely on SSLv3 still, should be be concerned about supporting them?

Best Answer

No, it will not break HTTPS connectivity to your website; TLSv1 (and newer versions, if your software is recent enough) is already being used instead by almost all browsers (with the notable exception of IE6 on Windows XP).

Verify in your configuration that TLSv1 is enabled, but it is by default in almost every server-side SSL configuration.