Enable TLS 1.2 Apache

Question

I want to enable TLS 1.2 in Ubuntu server 18.

I have edited the /etc/apache2/mods-available/ssl.conf, adding

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLHonorCipherOrder on

but still Apache is using tls 1.0. Is it possible to activate tls 1.2?

The Apache version is Apache/2.4.29 (Ubuntu)

Aren't you missing +TLSv1.2?

Álvaro González
– Álvaro González

2020-01-16 14:14:32 +00:00
Commented Jan 16, 2020 at 14:14 — Álvaro González
– Álvaro González, Commented Jan 16, 2020 at 14:14
@Álvaro González yes.

Example person
– Example person

2020-01-16 16:28:35 +00:00
Commented Jan 16, 2020 at 16:28 — Example person
– Example person, Commented Jan 16, 2020 at 16:28

Example person · Accepted Answer · 2023-05-22 09:12:41Z

12

To enable TLS 1.2 in Apache, you will need to change/add the SSLProtocol directive.

Note: To do any of this, mod_ssl should be enabled, if not, use the command sudo a2enmod ssl.

The below configuration line will disable all TLS versions except TLSv1.2.

SSLProtocol -all +TLSv1.2 #This makes Apache to support only TLSv1.2

You can also support TLSv1.3 if you have OpenSSL 1.1.1 or newer. You can check the OpenSSL version by running the command: openssl version in the terminal, etc. You will also need Apache version 2.4.36 or more to use the TLSv1.3 provided by OpenSSL. You can also support TLSv1.3 together with TLSv1.2 using SSLProtocol -all +TLSv1.2 +TLSv1.3.

edited May 22, 2023 at 9:12

answered Jan 16, 2020 at 10:58

Example person

3,3963 gold badges25 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

23 Comments

Lorik H Over a year ago

I ran command apachectl -M,-> ssl_module (shared),http_module (static), this are the modules I believe are linked with the command you said to run. Also when I ran command : openssl version OpenSSL 1.1.1 But when I change the ssl.conf, and added TLS 1.3, the apache didn't start

Example person Over a year ago

Run journalist -xe

Example person Over a year ago

See the output of that command. And see why Apache didn't start.

Example person Over a year ago

Change SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 to SSLProtocol -all +TLSv1.2

Example person Over a year ago

@Sajeev, I am pretty sure you are using Apache Tomcat. I cannot help you with that since I do not have any experience with it. I am sorry

|

Collectives™ on Stack Overflow

Enable TLS 1.2 Apache

1 Answer 1

23 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

23 Comments

Your Answer

Sign up or log in

Post as a guest

Related