In /etc/httpd/conf.d/ssl.conf, edit the two lines as below:
SSLProtocol TLSv1
SSLCipherSuite HIGH
Then go to
/etc/httpd/conf/httpd.conf and edit your
<Directory> </Directory>to include the following line:
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 256
Then
apachectl configtest
to check for typos.
Finally
/etc/rc.d/init.d/httpd restart
What this does is make browsers do
TLSv1 DHE-RSA-CAMELLIA256-SHA only.
You can then watch your SSL handshakes fail from IE and Chrome. If you want to require strong encryption across browsers, edit ssl.conf to look like this:
SSLProtocol TLSv1
SSLCipherSuite AES256-SHA
Then you'll have reasonably strong encryption.
Just testing SSO to google. wow.
ReplyDelete