Disabling TLS 1.0 in Apache 2.4

Question

I'm a non-technical-but-able-to-read-the-manual website owner. I am running Apache 2.4.10 on a Debian 9.0 server. I would like to disable TLS 1.0. I have read the Apache documentation for the SSLProtocol directive.

In my virtual host file, I used the following directive:

SSLProtocol all -TLSv1 -SSLv3

That didn't work, even after reloading and then restarting Apache. I then added the same directive to the ssl.conf file as well, just to be sure, and still no luck, even after reloading and restarting. I also tried the same things with the following directive:

SSLProtocol +TLSv1.1 +TLSv1.2

Still no luck. I did the following search just to see if I had used the SSLProtocol directive somewhere else in my configuration files, but again, no luck:

grep -R 'SSLProtocol' .

I also checked the .htaccess file for the website to make sure I hadn't overridden anything (though I don't know that you could change this setting in an .htaccess file). Any ideas? Thank you for your help!

Answer 1

In a large amount of cases for this "bug" it turns out that if you have letsencrypt installed on your server, it's configuration file sets protocols which are superseding ssl.conf or vhosts' settings:

/etc/letsencrypt/options-ssl-apache.conf

Bug 60739 - SSLProtocol settings seem to have no effect

Answer 2

As of today, 11/15/2018, there is a known bug about failing to disable tls1.0 in Apache 2.4. So don't hit your head when your modification just didn't work for no reason. Hopefully we can get it patched soon.

Also form the ticket

This seem to have changed somewhere between 2.4.18 + 2.4.23 as setting SSLProtocol use to be honored.

Answer 3

There is an answer for this questions here:

How to disable TLS 1.1 & 1.2 in Apache?

Basically, you have to disable this protocol in the ssl.conf file. Doing that in your vhosts.conf or equivalent file will not work (although it is right setting this configuration there), due a bug in OpenSSL, as reported in one of the answers cited there.