Related

Join the DigitalOcean Community Community

Join 1M+ other developers and:

  • Get help and share knowledge in Q&A
  • Subscribe to topics of interest
  • Get courses & tools that help you grow as a developer or small business owner
 Join Now
Does anyone have correct installation instructions for mod_cloudflare on Ubuntu 14.04? Question Question
How to move owncloud from www.mysite.com to www.mysite.com/owncloud Question Question

Question

Changing SSLCipherSuite on Wordpress Droplet

Posted April 27, 2017 2.6k views
UbuntuApacheDigitalOcean 1-Click Apps Marketplace

I’ve got a one-click app of wordpress running on Ubntu 14.04.1, I’ve upgraded and no matter what I change in the Apache config (with subsequent restart of Apache, or even VM) the cipher suite used never changes when I evaluate the HTTPS connection details from a client.

I greped to find all the instances of SSLCipherSuite in all of/etc/apache2 and the only uncommented specification of what cipher suite to use is my own:
SSLCipherSuite AES256+EECDH:AES256+EDH:HIGH

^ Note both defined are 256 bit bulk ciphers, yet no matter if I restart apache or the VM Calomel SSL validation on Firefox

What gives?

Add a comment
Jubal
By:
Jubal

Related

Join the DigitalOcean Community Community

Join 1M+ other developers and:

  • Get help and share knowledge in Q&A
  • Subscribe to topics of interest
  • Get courses & tools that help you grow as a developer or small business owner
 Join Now
Does anyone have correct installation instructions for mod_cloudflare on Ubuntu 14.04? Question Question
How to move owncloud from www.mysite.com to www.mysite.com/owncloud Question Question

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
2 answers
Jubal April 27, 2017

I meant to add that the bulk cipher my client is using to connect to the site is 128 bit AES

Reply Report
jtittle1 April 27, 2017

@Jubal

You may want to extend the configuration by adding:

SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on

… above the SSLCipherSuite directive. What you’d end up with is:

SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite AES256+EECDH:AES256+EDH:HIGH

…

That being said, I would recommend using what’s provided by https://cipherli.st:

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
# Requires Apache >= 2.4
SSLCompression off 
SSLUseStapling on 
SSLStaplingCache "shmcb:logs/stapling-cache(150000)" 
# Requires Apache >= 2.4.11
SSLSessionTickets Off

…

It’s important to keep in mind, the ciphers that you list in SSLCipherSuite will only be used when they are supported. If the connecting client does not support them, it’ll cause an error.

Reply Report

Related

Looking for something else?

Ask a new question Search for more help