Bug 1324460

Summary:	Can not configure TLS 1.2 for HTTPD
Product:	[JBoss] JBoss Enterprise Application Platform 6	Reporter:	Michael <michael_furman>
Component:	Apache Server (httpd) and Connectors	Assignee:	Jean-frederic Clere <jclere>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Michael Cada <mcada>
Severity:	high	Docs Contact:	David Michael <dmichael>
Priority:	unspecified
Version:	6.0.0	CC:	jorton, jpallich, mbabacek, mturk, rhatlapa, weli
Target Milestone:	DR1
Target Release:	EAP 6.4.9
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-17 14:46:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1340911
Bug Blocks:

Description Michael 2016-04-06 11:12:20 UTC

Description of problem:
We started to configure TLSv1.2 protocol for httpd in the customer environment
We need to do it to be PCI DSS 3.1 compliant.

We configure SSLProtocol as following (in file /etc/httpd/conf.d/ssl.conf):

SSLProtocol -ALL -SSLv3 +TLSv1.2

Unfortunately when we restarted httpd service we get this error:

service httpd start
Starting httpd: Syntax error on line 98 of /etc/httpd/conf.d/ssl.conf:
SSLProtocol: Illegal protocol 'TLSv1.2'

[FAILED]



Please note that according to this link it should be supported starting from openssl-1.0.1e-15: 
https://rhn.redhat.com/errata/RHBA-2013-1585.html




Version-Release number of selected component (if applicable):

rpm -q httpd
httpd-2.2.22-27.ep6.el6.x86_64

rpm -q openssl
openssl-1.0.1e-42.el6.x86_64




How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Michael 2016-04-14 06:18:05 UTC

Dear RedHat people,
Any comments on the bug?

Comment 3 Joe Orton 2016-04-14 07:37:43 UTC

Hi Michael, if you need help with a production system please always contact Red Hat Support in the first instance; bugzilla is not a support tool.

It looks like your issue is with EAP packages, so I'm re-assigning this.

Comment 4 Michal Karm Babacek 2016-09-30 13:24:02 UTC

Works
VERIFIED
SSLProtocol -ALL -SSLv3 +TLSv1.2

Comment 5 Petr Penicka 2017-01-17 14:46:43 UTC

Retroactively bulk-closing issues from released EAP 6.4 cumulative patches.