Bug 1388068 - mod_ssl: Change default SSLProtocol value to +TLSv1.2 +TLSv1.1 in ssl.conf to support only secure TLS versions
Summary: mod_ssl: Change default SSLProtocol value to +TLSv1.2 +TLSv1.1 in ssl.conf to...
Keywords:
Status: CLOSED DUPLICATE of bug 1274890
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: httpd
Version: 7.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Luboš Uhliarik
QA Contact: BaseOS QE - Apps
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-24 11:18 UTC by David Jaša
Modified: 2016-12-06 11:09 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-12-06 11:09:41 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description David Jaša 2016-10-24 11:18:28 UTC 
Description of problem:
SSL 3.0 and TLS 1.0 are not considered secure anymore for quite some time so we should not listen on them

Version-Release number of selected component (if applicable):
mod_ssl-2.4.6-40.el7_2.4.x86_64

How reproducible:
always

Steps to Reproduce:
1. install httpd with mod_ssl on fresh RHEL 7 system
2. check SSLProtocol directive in /etc/httpd/conf.d/ssl.conf
3.

Actual results:
SSLProtocol all -SSLv2

Expected results:
SSLProtocol +TLSv1.2 +TLSv1.1
or
SSLProtocol all -SSLv2 -SSLv3 -TLSv1

Additional info:
related RHV bug (its TLS > 1.0 intolerance): Bug 1387996, similar bugs in other products may also appear.
Note You need to log in before you can comment on or make changes to this bug.