Project

General

Profile

[Solved] Disabling TLS1.0 using lighttpd.conf

Added by AshHema over 8 years ago

Hi ,
My system is
FreeBSD 10.2
OpenSSL 1.0.1p
lighttpd :lighttpd-1.4.23
Am trying to disable TLS1.0 through lighttpd.conf and have followed the same steps as mentioned in the link
https://redmine.lighttpd.net/boards/2/topics/6749?r=6755#message-6755

I also tried steps mentioned in the link for lighttpd
https://cipherli.st/

After I do the changes as mentioned in the link,I see that TLSv1.0 is still accepted

Apart from sslscan,is there any way I ensure that TLSv1.0 is disabled?
Am very new to this and have just started working with lighttpd.

Please suggest inputs regarding the same.
Thanks in advance.

Below is my lighttpd.conf

(..)
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.use-compression = "disable"
ssl.disable-client-renegotiation = "enable"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:\
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:\
DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:\
ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:\
ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:\
DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:\
eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"

setenv.add-response-header = (
"Strict-Transport-Security" => "max-age=63072000; includeSubDomains; preload",
"X-Frame-Options" => "DENY",
"X-Content-Type-Options" => "nosniff"
)
(..)


Replies (4)

RE: Disabling TLS1.0 using lighttpd.conf - Added by gstrauss over 8 years ago

Please do not spam and cross-post all over the place. If I wasn't cleaning up your spray (#2776, #2777), I might have a moment to try to answer your question.

lighttpd-1.4.23 is very old, over 7 years old. You might try upgrading before you continue troubleshooting.

Please see
Disable TLS 1.0 / TLS 1.1 in Lighttpd
https://redmine.lighttpd.net/boards/2/topics/5797 and review the links to Docs_SSL
and review (again)
DISABLE TLS 1.0 - SOLVED
https://redmine.lighttpd.net/boards/2/topics/6749

RE: Disabling TLS1.0 using lighttpd.conf - Added by gstrauss over 4 years ago

lighttpd 1.4.48 supports ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2") See lighttpd TLS documentation

    (1-4/4)