Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
openssl-1.0.2 is needed for Apache to follow logjam Hints
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3648
Location: Hamburg

PostPosted: Fri May 22, 2015 4:51 pm    Post subject: openssl-1.0.2 is needed for Apache to follow logjam Hints Reply with quote

Otherwise you get a
Code:
/etc/init.d/apache2 restart
 * apache2 has detected an error in your setup:
AH00526: Syntax error on line 40 of /etc/apache2/vhosts.d/00_default_ssl_vhost.conf:
Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration
 * ERROR: apache2 failed to stop
when trying to add
Code:
SSLOpenSSLConfCmd DHParameters /etc/ssl/private/dhparams.pem
to apache2's config file (as advised in https://weakdh.org/sysadmin.html)
Back to top
View user's profile Send private message
Duncan Mac Leod
Apprentice
Apprentice


Joined: 02 May 2004
Posts: 251
Location: Germany

PostPosted: Fri May 22, 2015 9:05 pm    Post subject: Reply with quote

No, it is NOT!

Look at my earlier posting: https://forums.gentoo.org/viewtopic-t-1017546.html

I eliminated all DHE ciphers, only ECDHE ciphers are enabled, so you can go with openssl-1.0.1m and with Apache 2.2.x.

Using SSLOpenSSLConfCmd won't run on Apache < 2.4.8 and yes, you are right, it'll need openssl-1.0.2.

So, why use DHE at all? With ECDHE you are save against Logjam and my solution (plz look at my other posting) offers good compatibility with most clients.
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3648
Location: Hamburg

PostPosted: Sun May 24, 2015 10:17 am    Post subject: Reply with quote

I'm do wonder if it the right time to completely ignore DHE and just juse ECDHE.
DHE is still a good choice / fall back as long as elliptic curves aren't proved (over a long time) to be a safe replace.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum