☰

更改 Plesk 11.5 和 Ubuntu 12.04 中 Apache2 使用的 SSL 密码

tag-icon • tag-icon ubuntu ssl apache-http-server parallels plesk
更改 Plesk 11.5 和 Ubuntu 12.04 中 Apache2 使用的 SSL 密码

我想更改我的 Apache2 服务器的配置，以便它接受以下行，以禁用弱 TLS 密码并启用完美的前向保密。

SSLProtocol all -SSLv2 -SSLv3
SSLCompression Off
SSLHonorCipherOrder on 
SSLCipherSuite "EECDH+AESGCM EDH+AESGCM EECDH -RC4 EDH -CAMELLIA -SEED !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

但是，我有点困惑。服务器上预装了 Plesk 11.5，用于管理 Apache2 Web 服务器。我更改了

/etc/apache2/mods-enabled/ssl.conf

然后通过输入以下命令重新启动 apache

service apache2 restart

但是，sslscan 返回以下内容：

phil@phil-desktop:~$ sslscan www.phkr.de | grep Accepted
Accepted  SSLv3  256 bits  DHE-RSA-AES256-SHA
Accepted  SSLv3  256 bits  DHE-RSA-CAMELLIA256-SHA
Accepted  SSLv3  256 bits  AES256-SHA
Accepted  SSLv3  256 bits  CAMELLIA256-SHA
Accepted  SSLv3  168 bits  EDH-RSA-DES-CBC3-SHA
Accepted  SSLv3  168 bits  DES-CBC3-SHA
Accepted  SSLv3  128 bits  DHE-RSA-AES128-SHA
Accepted  SSLv3  128 bits  DHE-RSA-SEED-SHA
Accepted  SSLv3  128 bits  DHE-RSA-CAMELLIA128-SHA
Accepted  SSLv3  128 bits  AES128-SHA
Accepted  SSLv3  128 bits  SEED-SHA
Accepted  SSLv3  128 bits  CAMELLIA128-SHA
Accepted  SSLv3  128 bits  RC4-SHA
Accepted  SSLv3  128 bits  RC4-MD5
Accepted  TLSv1  256 bits  DHE-RSA-AES256-SHA
Accepted  TLSv1  256 bits  DHE-RSA-CAMELLIA256-SHA
Accepted  TLSv1  256 bits  AES256-SHA
Accepted  TLSv1  256 bits  CAMELLIA256-SHA
Accepted  TLSv1  168 bits  EDH-RSA-DES-CBC3-SHA
Accepted  TLSv1  168 bits  DES-CBC3-SHA
Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA
Accepted  TLSv1  128 bits  DHE-RSA-SEED-SHA
Accepted  TLSv1  128 bits  DHE-RSA-CAMELLIA128-SHA
Accepted  TLSv1  128 bits  AES128-SHA
Accepted  TLSv1  128 bits  SEED-SHA
Accepted  TLSv1  128 bits  CAMELLIA128-SHA
Accepted  TLSv1  128 bits  RC4-SHA
Accepted  TLSv1  128 bits  RC4-MD5

所以我认为我必须在其他地方更改配置？

任何帮助都值得感激，谢谢！

答案1

我终于明白了。创建文件

/etc/apache2/conf.d/zz050-psa-disable-weak-ssl-ciphers.conf

并添加线条即可达到目的。

相关内容