ssl checker

ssl checker show This server is vulnerable to the POODLE attack. If possible, disable SSL 3 t`

POODLE attacks on SSLv3 vulnerability

ssl checker

https://www.sslshopper.com/ssl-checker.html

https://www.ssllabs.com

my centos /etc/httpd/conf.d/ssl.conf

中的

SSLProtocol all  -SSLv2

改为

SSLProtocol all -SSLv3 -SSLv2

SSL证书https在线测试，故障检测网站ssllabs评分较低和较高的原因分析

SSLCipherSuite EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DE

更进一步的提高 SSL 的安全性，支持 Forward Secrecy

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4
SSLHonorCipherOrder on
SSLProtocol all -SSLv3

This server's certificate chain is incomplete. Grade capped to B.

修改 centos /etc/httpd/conf.d/ssl.conf 中

SSLCertificateKeyFile /etc/letsencrypt/live/[FQDN]/privkey.pem
SSLCertificateFile /etc/letsencrypt/live/[FQDN]/fullchain.pem

爲

SSLCertificateKeyFile /etc/letsencrypt/live/[FQDN]/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/archive/[FQDN]/chain1.pem
SSLCertificateFile /etc/letsencrypt/live/[FQDN]/fullchain.pem

或者

SSLCertificateKeyFile /etc/letsencrypt/live/[FQDN]/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/[FQDN]/chain.pem
SSLCertificateFile /etc/letsencrypt/live/[FQDN]/fullchain.pem

添加了 chain1.pem 之后， ssllab 显示 A 评分了

References

1. How To Protect your Server Against the POODLE SSLv3 Vulnerability
2. How to disable SSLv3 in Apache?
3. This server’s certificate chain is incomplete. Grade capped to B. openshift