Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Secure Apache against Logjam and get A+ on Qualys SSL Labs
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Duncan Mac Leod
Apprentice
Apprentice


Joined: 02 May 2004
Posts: 251
Location: Germany

PostPosted: Thu May 21, 2015 2:50 pm    Post subject: Secure Apache against Logjam and get A+ on Qualys SSL Labs Reply with quote

To get an A+ on Qualys SSL Labs (https://www.ssllabs.com/ssltest/index.html) AND to prevent Logjam attacks (https://weakdh.org/sysadmin.html):

SSLProtocol all -SSLv2 -SSLv3

SSLCompression Off

SSLHonorCipherOrder On

SSLCipherSuite "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!EDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 7048
Location: almost Mile High in the USA

PostPosted: Fri May 22, 2015 12:31 am    Post subject: Reply with quote

Now I need to get a traceable (instead of a self-signed) certificate...
Thanks.
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
randalla
Tux's lil' helper
Tux's lil' helper


Joined: 14 Oct 2008
Posts: 79
Location: Seattle, WA

PostPosted: Fri May 22, 2015 8:39 pm    Post subject: Reply with quote

This helped us out a lot here in our office. I tested with Qualys and got the A+, and it seems that it still supports compatibility where we need it.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum