Get Paid to Participate - up to $1 per post!     Twitter     Facebook     Google+
Hosting Discussion
 

Hosting Discussion > Web Hosting Forums > Web Hosting Discussion > Has anyone else remove SSLv3 from their Cipher Suites?
forgot password?



Reply


Old
  Post #1 (permalink)   10-27-2014, 10:02 AM
HD Community Advisor
 
ughosting's Avatar
 
Join Date: Jan 2011
Location: London
Posts: 604

Status: ughosting is offline
Whilst we've not seen any shared hosting customers affected by this, we've had larger infrastructure clients requesting to have this removed due to POODLE.

We've followed suit and down the shared/reseller servers fixed too.

Anyone else done this?
__________________
DDoS Protected, LiteSpeed + LiteMage on CloudLinux with SSD Disks, R1Soft, Softaculous, SIteBuilder, BitNinja, LetsEncypt & Patchman
UnixGuru: Accounts with 1-16 CPU Cores, 2-32GB RAM. Why use a VPS?
█ Choose from Shared, Reseller and Elastic-Sites Hosting
 
 


Old
  Post #2 (permalink)   10-28-2014, 08:28 AM
HD Addict
 
Join Date: Sep 2014
Location: India
Posts: 239
Send a message via Skype™ to 24x7server

Status: 24x7server is offline
Hi,

Yes, we have done this on many of the servers. Some of them were patched successfully and some of them were not. The SSL certificate on the same server gives some strange behavior like one gives handshake okay and other shows no handshake on SSLv3.

I guess this is not yet affecting as such.
__________________
www.24x7servermanagement.com
Server Management, Server Security, Server Monitoring.
Network Monitoring Team !! Skype: techs24x7
 
 
 


Old
  Post #3 (permalink)   10-28-2014, 10:12 AM
HD Addict
 
Join Date: Aug 2014
Posts: 105

Status: MarkPoppen is offline
Quote:
Originally Posted by 24x7server View Post
Hi,

Yes, we have done this on many of the servers. Some of them were patched successfully and some of them were not. The SSL certificate on the same server gives some strange behavior like one gives handshake okay and other shows no handshake on SSLv3.

I guess this is not yet affecting as such.
We have the handshaking issue. Can't quite figure out how to fix it.
__________________
█ ♥ █ PoppenWorks, Canadian web design, development and hosting. Now with 24/7 support.
 
 
 


Old
  Post #4 (permalink)   10-28-2014, 10:26 AM
HD Community Advisor
 
ughosting's Avatar
 
Join Date: Jan 2011
Location: London
Posts: 604

Status: ughosting is offline
In your apache config, somewhere it will list the protocols that your apache will attempt, in the order it will attempt to negotiate the connection in.
In theory you just remove SSLv3 from the list.

If you have no such list, and an implied default is present, then insert the configuration without SSLv3, and you should be fine.

Don't forget to restart apache after you make the change.
__________________
DDoS Protected, LiteSpeed + LiteMage on CloudLinux with SSD Disks, R1Soft, Softaculous, SIteBuilder, BitNinja, LetsEncypt & Patchman
UnixGuru: Accounts with 1-16 CPU Cores, 2-32GB RAM. Why use a VPS?
█ Choose from Shared, Reseller and Elastic-Sites Hosting

Last edited by ughosting : 10-28-2014 at 10:30 AM.
 
 
 
Reply

Thread Tools

New Post New Post   Old Post Old Post
Posting Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Sponsored By: