[Solved] Disabling TLS1.0 using lighttpd.conf
Added by AshHema over 8 years ago
Hi ,
My system is
FreeBSD 10.2
OpenSSL 1.0.1p
lighttpd :lighttpd-1.4.23
Am trying to disable TLS1.0 through lighttpd.conf and have followed the same steps as mentioned in the link
https://redmine.lighttpd.net/boards/2/topics/6749?r=6755#message-6755
I also tried steps mentioned in the link for lighttpd
https://cipherli.st/
After I do the changes as mentioned in the link,I see that TLSv1.0 is still accepted
Apart from sslscan,is there any way I ensure that TLSv1.0 is disabled?
Am very new to this and have just started working with lighttpd.
Please suggest inputs regarding the same.
Thanks in advance.
Below is my lighttpd.conf
(..)
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.use-compression = "disable"
ssl.disable-client-renegotiation = "enable"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:\
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:\
DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:\
ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:\
ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:\
DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:\
eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
setenv.add-response-header = (
"Strict-Transport-Security" => "max-age=63072000; includeSubDomains; preload",
"X-Frame-Options" => "DENY",
"X-Content-Type-Options" => "nosniff"
)
(..)
Replies (4)
RE: Disabling TLS1.0 using lighttpd.conf - Added by gstrauss over 8 years ago
Please do not spam and cross-post all over the place. If I wasn't cleaning up your spray (#2776, #2777), I might have a moment to try to answer your question.
lighttpd-1.4.23 is very old, over 7 years old. You might try upgrading before you continue troubleshooting.
Please see
Disable TLS 1.0 / TLS 1.1 in Lighttpd
https://redmine.lighttpd.net/boards/2/topics/5797 and review the links to Docs_SSL
and review (again)
DISABLE TLS 1.0 - SOLVED
https://redmine.lighttpd.net/boards/2/topics/6749
RE: Disabling TLS1.0 using lighttpd.conf - Added by gstrauss over 8 years ago
More in-depth discussion about TLS/1.0 and RC4 can be found at https://raymii.org/s/tutorials/Strong_SSL_Security_On_lighttpd.html
RE: Disabling TLS1.0 using lighttpd.conf - Added by gstrauss over 8 years ago
More discussion about disabling TLS protocol at protocol level and cipher list:
http://security.stackexchange.com/questions/83462/disabling-tls-protocol-in-protocol-level-or-in-cipher-list-level-whats-the-dif
RE: Disabling TLS1.0 using lighttpd.conf - Added by gstrauss over 4 years ago
lighttpd 1.4.48 supports ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2")
See lighttpd TLS documentation