Apache – Can’t disable SSLv3 in Apache + mod_nss

apache-httpdrhelssl

I am trying to implement TLS through mod_nss in Apache (RHEL 7). As per the documentation, I have installed mod_nss and removed mod_ssl.

I have followed the steps outlined in the documentation (see above link), especially making sure that the NSSProtocol directive reads as follows (according to the docs, this disables all SSL and TLS protocol versions except TLS version 1 and higher):

NSSProtocol TLSv1.0,TLSv1.1

Then I restarted Apache and tested whether SSLv3 is enabled:

openssl s_client -connect localhost:443 -ssl3

which returns:

[root@box1 ~]# openssl s_client -connect localhost:443 -ssl3
CONNECTED(00000003)
139894684407712:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1442107224
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
[root@box1 ~]#

As you can see, the handshake completes (as indicated by SSL handshake has read 5 bytes and written 7 bytes) so that makes me doubt that SSLv3 has been actually disabled.

I have spent countless hours searching for a solution but everything I've been able to found tells me how to disable SSLv3 through mod_ssl, not mod_nss.

Any ideas or clarifications will be more than welcome.

Best Answer

Nothing bad has happened, as you got an handshake error:

error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

How can client/server decide that the version number is wrong without sending bytes?

Remove the -ssl3 from your command and you will see the difference:

SSL handshake has read 4493 bytes and written 499 bytes

Also if the connection is established, s_client waits for your input to transfer it to the server. With no connection, it returns.

Related Question