Turn off TLS1.0 on Apache for PCI compliance

Question

Pci DSS compliance stated that by June 2016 TLSv1.0 must be disabled. My cursory search taught me that a -TLSv1 in the SSLProtocals portion of the apache config would care for it (right next to the -SSLv3). I have tried each of the following lines in my /etc/apache2/conf_available/https.conf, but to no avail. I cannot figure out why changing these protocols makes no difference on my server (Apache/2.4.25 on Ubuntu 16.04)

SSLProtocol -all -SSLv3 -TLSv1 +TLSv1.1 +TLSv1.2
SSLProtocol -all +TLSv1.2
SSLProtocol +TLSv1.1 +TLSv1.2
SSLProtocol -TLSv1 +TLSv1.1 +TLSv1.2

Everytime I test with https://www.ssllabs.com/ssltest/index.html, I get the same result - TLSv1 is never turned off. What am I missing here? Are the TLS versions dependent on each other?

Promising Links that did not work for me
http://utdream.org/post.cfm/how-to-disable-tlsv1-0-for-pci-compliance-in-apache-2-2
https://ubuntuforums.org/showthread.php?t=2288000

Do you have another dir called `/etc/apache2/conf_enabled/` ? — Aaron, Jun 22 '17 at 21:37
Yes, there is a simlink for httpd.conf in /etc/apache2/conf-enabled — wruckie, Jun 22 '17 at 21:40
you probably then also need a symlink for https.conf in conf-enabled. — Aaron, Jun 22 '17 at 21:43
Do you have the default `ssl.conf` also enabled, which has `SSLProtocol all` in it, and which would follow and likely override your `https.conf`? — Colt, Jun 23 '17 at 01:07
What's the output of grep -iIR SSLProtocol /etc/apache2/* ? do you stop and start apache (no restart) after configuration changes? — bgtvfr, Aug 16 '17 at 13:37

score 2 · Answer 1 · answered Jun 23 '17 at 09:32

That just means the file you are configuring is not being loaded.

Try defining SSLProtocol TLSv1.2 in the main config file "apache2.conf" or however it is called.

When you use one of this "multifile" configuration schemes from distro you need to have great control of whats happening behind the scenes. And Apache could not care less about files, it just cares about "context". So, define the above in server config context, use "mod_info" if you need to be sure the directive is being loaded correctly.

score 0 · Answer 2 · answered Apr 27 '21 at 19:12

It took me a long time to find my answer. I was using Lets Encrypt, and LE has a file in their directory that is seemingly loaded last as the settings there overwrite everything else.

 /etc/letsencrypt/options-ssl-apache.conf

If you are using Lets Encrypt and Apache, pay special attention to what is in this file.

Turn off TLS1.0 on Apache for PCI compliance

2 Answers2