How to disable TLS 1.1 & 1.2 in Apache? – Problems with loading a website are often blamed on the Internet connection, but even the most perfectly set up network cannot help if there is no service to reply at your destination. One of the most popular HTTP servers used for this task is Apache2. Much of Apache’s popularity can be attributed to its easy installation and use, but never the less it is possible to run into problems with even the easiest of the software. If you’ve encountered an issue loading your web page, follow these simple troubleshooting methods outlined in this guide to attempt to get your web server back up and working again. Below are some tips in manage your apache2 server when you find problem about apache-2.2, ssl, openssl, tls, mod-ssl.
I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1.
In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line with -all +SSLv3.
With that configuration, TLS 1.1 & 1.2 are enabled and work correctly – which is counter-intuitive to me, as I would expect that only SSLv3 would be enabled given that configuration.
I can enable/disable TLSv1 just fine with -/+TSLv1, and it works as expected. But +/-TLSv1.1 and +/-TLSv1.2 are not valid configuration options – so I can’t disable them that way.
As for why I’d want to do this – I’m dealing with a third party application (which I have no control over) that has some buggy behavior with TLS enabled servers, and I need to completely disable it to move forward.
Intrigued by this bug (and yes, I’ve been able to reproduce it) I’ve taken a look at the source code for the latest stable version of mod_ssl and found an explanation. Bear with me, this is gonna get amateur-stack-overflowish:
When the SSLProtocol has been parsed, it results in a char looking something like this:
0 1 0 0
^ ^ ^ ^
| | | SSLv1
| | SSLv2
| SSLv3
TLSv1
Upon initiating a new server context, ALL available protocols will be enabled, and the above char is inspected using some nifty bitwise AND operations to determine what protocols should be disabled. In this case, where SSLv3 is the only protocol to have been explicitly enabled, the 3 others will be disabled.
OpenSSL supports a protocol setting for TLSv1.1, but since the SSLProtocol does not account for this options, it never gets disabled. OpenSSL v1.0.1 has some known issues with TLSv1.2 but if it’s supported I suppose the same goes for that as for TLSv1.1; it’s not recognized/handled by mod_ssl and thus never disabled.
Source Code References for mod_ssl:
SSLProtocol gets parsed at line 925 in pkg.sslmod/ssl_engine_config.c
The options used in the above function is defined at line 444 in pkg.sslmod/mod_ssl.h
All protocols gets enabled at line 586 in pkg.sslmod/ssl_engine_init.c whereafter specific protocols gets disabled on the subsequent lines
How to disable it then?
You have a few options:
- Disable it in the OpenSSL config file with:
Protocols All,-TLSv1.1,-TLSv1.2 - Rewrite
mod_ssl😉
The issue is also addressed at the comments on the mod_ssl Apache page: http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#comment_1136
If Ubuntu 12.04 had Apache 2.2.23, the problem would not have occurred. According to the comments, it is possible to enable TLSv1.1 and TLSv1.2, but TLSv1.0 is then enabled as well:
SSLProtocol All -SSLv2 -SSLv3
First of all, you must identify what is the default vhost for port 443 in your server (the first SSL vhost loaded by Apache) and edit it’s configuration file.
Most users have an ssl.conf file in their servers, with a vhost for port 443 configured there. As the name of this file begins with “s”, it will load before the vhosts configured in vhosts.conf (which begins with “v”).
So, check if this is your case (the answer is “yes” for virtually everyone) and change the protocols in that file. That’s enough!
A similar issue was posted here: How to disable TLS 1.1 & 1.2 in Apache?. According to HBruijn:
Unless you have IP VirtualHosts, in practice the settings from the
first occurrence of the SSLProtocol directive are used for the whole
server and/or all name-based VirtualHosts supporting TLS
And another here: Is it possible to set an SSLProtocol in Apache for a single VirtualHost (poodle)?. According to vallismortis:
You can set the SSLProtocol only for the first VirtualHost in the
configuration file. All subsequent VirtualHost entries will inherit
that setting from the first entry and silently ignore their own
setting due to an OpenSSL bug.
By the way: the default vhost in a server, for a given port, is the one that answers the requests for that port, which arrive at the server without a server name identification (or with a wrong server name). Example: an IP typed in your browser’s address bar or an erroneous redirect caused by an incorrect DNS table.