Solved

Cipher Configuration on Apache HTTPD

Posted on 2016-11-28

1 solution

93 Views

Last Modified: 2016-11-30

Hello Experts:

I need to configure Apache HTTPD to only take the following ciphers:

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp256r1 (eq. 3072 bits RSA) FS
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp256r1 (eq. 3072 bits RSA) FS
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)

This is what I have in my ssl.conf configuration file:

SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite AES128+EECDH:AES128+EDH:!3DES:!DES

I am confused on how to translate the above ciphers into the proper Apache syntax.

Apache/2.2.15
CentOS release 6.5 (Final)

OpenSSL 1.0.1e-fips 11 Feb 2013
java version "1.7.0_45"

Thanks.

Comment

Question by:willie0-360

[X]

Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

Help others & share knowledge
Earn cash & points
Learn & ask questions

Join The Community

4 Comments

LVL 14

Accepted Solution

by:Phil Phillips

Phil Phillips earned 500 total points

ID: 419049222016-11-28

Apache uses the format that OpenSSL uses. This page has a translation from the specification name to the OpenSSL equivalent: https://www.openssl.org/docs/man1.0.2/apps/ciphers.html

So, in your case, the SSLCipherSuite line would look like:

SSLCipherSuite ECDHE-RSA-AES256-SHA:AES256-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA

Open in new window

Author Comment

by:willie0-360

ID: 419049712016-11-28

That looks very promising Phil. By any chance, can you help me understand what these other expressions mean:

(0xc014) ECDH secp256r1 (eq. 3072 bits RSA) FS

(0x35)

(0x2f)

Thanks very much.

LVL 14

Expert Comment

by:Phil Phillips

ID: 419049962016-11-28

ECDH refers to the encryption protocol (Elliptic curve Diffie–Hellman)
secp256r1 refers to the elliptic curve used by the cipher
FS indicates that the cipher supports Forward Secrecy

I'm not sure what (0xc014)/(0x35)/(0x2f) are, but I'm guessing it's a constant associated with the cipher.

Author Comment

by:willie0-360

ID: 419079642016-11-30

Thanks a lot for your help.
It worked!
Excellen!
Grade: A

Featured Post

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Creating Spreadsheets in Java via Apache POI (HSSF)

Article by: Bruce

Are you developing a Java application and want to create Excel Spreadsheets? You have come to the right place, this article will describe how you can create Excel Spreadsheets from a Java Application. For the purposes of this article, I will be u…

Java

Profiling Java 8 with Java Flight Recorder and Java Mission Control in Eclipse

Article by: Jan

Java Flight Recorder and Java Mission Control together create a complete tool chain to continuously collect low level and detailed runtime information enabling after-the-fact incident analysis. Java Flight Recorder is a profiling and event collectio…

Java

Loops (Part 2)

Video by: Michael

Viewers learn about the “for” loop and how it works in Java. By comparing it to the while loop learned before, viewers can make the transition easily. You will learn about the formatting of the for loop as we write a program that prints even numbers…

Introduction to VisualVM (Part 2)

Video by: Amitkumar

This tutorial explains how to use the VisualVM tool for the Java platform application. This video goes into detail on the Threads, Sampler, and Profiler tabs.