Is SSLv3 disabled on my Apache 2.4.9 (Win32?)

1.6k Views Asked by At

I have Apache 2.4.9 running on windows Server 2008 R2.

SERVER_SOFTWARE                          Apache/2.4.9 (Win32) PHP/5.5.12 OpenSSL/1.0.1g 
SSL_PROTOCOL                             TLSv1.2 
Registered Stream Socket Transports      tcp, udp, ssl, sslv3, sslv2, tls

I need to immediately disable SSLv3 to prevent Poodle attacks. TO do that I opened the file \conf\extra\httpd-ssl.conf

Then I added the following line of code to it

SSLProtocol All -SSLv2 -SSLv3

After saving the changes, I restarted Apache.

When came back up, I looked at the output of phpinfo() but I still can see the following

SSL_PROTOCOL TLSv1.2 Registered Stream Socket Transports tcp, udp, ssl, sslv3, sslv2, tls

Is the phpinfo() where I check to see if the SSLv3 and SSLv2 are disabled or not?

Here are more methods I have done to ensure I am doing this correctly. I tried adding this line instead of the other command (ie. SSLProtocol All -SSLv2 -SSLv3)

SSLHonorCipherOrder On
SSLProtocol -All +TLSv1.2

I even tried to searching for any file that contains the word "SSLProtocol" inside Apache24 directory like so

C:\Apache24>findstr /s /i /p "SSLProtocol" *.*

this only found 2 files

  1. httpd-ssl.conf
  2. CHANGES.txt

How to check if SSLv3 is disabled or not on my server? If It is not disabled yet, how to properly disable it?

2

There are 2 best solutions below

0
On

SSLProtocol All -SSLv2 -SSLv3 should disable SSLv3 protocol in your Apache installation.For reference.
I would not be sure about phpinfo() however if you want to see the enabled protocols on your site. Browse here and enter your site address.Found this post here . You can user openssl as well to check absence of SSLv3. Use below command to see what SSL protocols are enabled

openssl s_client -connect {SERVER_IP/DNS_NAME}:443

To see other promising tools you can Google and give it a try.
Hope that helps!

0
On

SSLProtocol All -SSLv2 -SSLv3 should have disabled SSL3 in Apache. You can check this (and other settings) at https://www.ssllabs.com/ssltest/index.html