无法在Amazon Linux实例上禁用SSLv3

Question

我使用的是Go Daddy颁发的SSL证书。在我的Linux实例上，以下是软件细节：-

• Apache版本-Apache/2.4.16（亚马逊）
• OpenSSL版本-OpenSSL 1.0.1k-FIPS 8 2015年1月8日
• mod_ssl版本-mod_ssl-2.4.2

注意：-我从RPM包安装Apache，以后我从RPM包安装mod_ssl和openssl。

1）问题是当我禁用SSLv3并从https://www.ssllabs.com/ssltest/测试SSL服务器时，它会警告我“此服务器不支持当前最好的TLSv1.2”，当我启用TLSv1.2协议时，相同的测试会警告我“此服务器支持SSLv3协议，易受狮子狗攻击”如何在服务器上同时禁用SSLv3并启用TLSv1.2？关于SSL的Vhost文件的当前配置是：

SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder     on

2）我无法创建强Diffie-Hellman组。当前是1024位Diffie-Hellman组，希望为站点创建2048位组。我发出以下命令来生成2048位密钥：-

openssl dhparam -out dhparams.pem 2048

我在VHost中的配置是：

SSLOpenSSLConfCmd DHParameters /etc/httpd/dhparams.pem

当我重新启动服务器时，弹出错误消息：

Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration

如何解决这个问题？

CONNECTED(00000003)
>>> ??? [length 0005]

>>> TLS 1.2 Handshake [length 0138], ClientHello

<<< ??? [length 0005]

<<< TLS 1.2 Handshake [length 003a], ServerHello

<<< ??? [length 0005]

<<< TLS 1.2 Handshake [length 12a7], Certificate

depth=3 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2     
Certification Authority
verify error:num=19:self signed certificate in certificate chain
<<< ??? [length 0005]

<<< TLS 1.2 Handshake [length 020f], ServerKeyExchange

<<< ??? [length 0005]

<<< TLS 1.2 Handshake [length 0004], ServerHelloDone

>>> ??? [length 0005]

>>> TLS 1.2 Handshake [length 0086], ClientKeyExchange

>>> ??? [length 0005]

>>> TLS 1.2 ChangeCipherSpec [length 0001]

>>> ??? [length 0005]

>>> TLS 1.2 Handshake [length 0010], Finished

<<< ??? [length 0005]

<<< TLS 1.2 Handshake [length 00ca]???

<<< ??? [length 0005]

<<< TLS 1.2 ChangeCipherSpec [length 0001]

<<< ??? [length 0005]

<<< TLS 1.2 Handshake [length 0010], Finished

>>> ??? [length 0005]

>>> SSL 3.0 Handshake [length 0099], ClientHello

<<< ??? [length 0005]

<<< SSL 3.0 Alert [length 0002], fatal handshake_failure

CONNECTED(00000003)
>>> ??? [length 0005]

>>> TLS 1.2 Handshake [length 0138], ClientHello

<<< ??? [length 0005]

>>> ??? [length 0005]

>>> TLS 1.0 Alert [length 0002], fatal protocol_version

[Tue Nov 24 07:50:13.019993 2015] [ssl:info] [pid 6419] [client 127.0.0.1:32836] AH01964: Connection to child 2 established (server site1.example.com:443)
[Tue Nov 24 07:50:13.023693 2015] [ssl:info] [pid 6419] [client 127.0.0.1:32836] AH02008: SSL library error 1 in handshake (server site1.example.com:443)
[Tue Nov 24 07:50:13.023752 2015] [ssl:info] [pid 6419] SSL Library Error: error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version (SSL alert number 70)
[Tue Nov 24 07:50:13.023789 2015] [ssl:info] [pid 6419] [client 127.0.0.1:32836] AH01998: Connection closed to child 2 with abortive shutdown (server site1.example.com:443)

这两个结果都没有显示TLSV1.2协议的迹象。我认为sslscan只扫描SSLv3和TLSv1.1协议。现在，当我在SSLLab上使用SSLProtocol all测试此结果时，配置中不使用SSLv2-SSLv3时：-

它说TLSV1.2是启用的。

Answer 1

添加以下行&检查
SSLProtocol all-SSLv2-SSLv3+TLSv1.2