[SOLVED] Can't disable SSLv3 in Apache + mod_nss

gacanepa · 09-12-2015, 08:33 PM

Hi everyone,

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl.

I have followed the steps outlined in the documentation (see above link), especially making sure that the NSSProtocol directive reads as follows (according to the docs, this disables all SSL and TLS protocol versions except TLS version 1 and higher):

Code:

NSSProtocol TLSv1.0,TLSv1.1

Then I restarted Apache and tested whether SSLv3 is enabled:

Code:

openssl s_client -connect localhost:443 -ssl3

which returns (output has been truncated for brevity):

Code:

[root@box1 ~]# openssl s_client -connect localhost:443 -ssl3
CONNECTED(00000003)
139894684407712:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol  : SSLv3
Cipher    : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg   : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1442107224
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
---
[root@box1 ~]#

As you can see, the handshake completes (as indicated by SSL handshake has read 5 bytes and written 7 bytes) so that makes me doubt that SSLv3 has been actually disabled.

I have spent countless hours searching for a solution but everything I've been able to found tells me how to disable SSLv3 through mod_ssl, not mod_nss.

Any ideas or clarifications will be more than welcome.

thesnow · 09-14-2015, 12:13 PM

That's the message you'll see when it IS disabled, otherwise you'll get certificate and non-empty SSL session information. If you pass in ssl2 instead of ssl3 it will also fail, but probably with a slightly different message.

gacanepa · 09-14-2015, 12:20 PM

Quote:

Originally Posted by thesnow

That's the message you'll see when it IS disabled, otherwise you'll get certificate and non-empty SSL session information. If you pass in ssl2 instead of ssl3 it will also fail, but probably with a slightly different message.

Thank you! I also got the same answer in the Unix & Linux Stack Exchange site. I am adding it here as well for my own reference.