Apache / OpenSSL configuration keywords `SSLProtocol` vs. `SSLCipherSuite`
1
vote
1
answer
2365
views
According to the [Apache docs](http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslciphersuite) I can configure the cipher suite with (a.o.) two different keywords and examples on Internet often use both (but not necessarily identical to below example).
What is the difference between
SSLProtocol
and SSLCipherSuite
, should I use them either or both?
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ALL:!SSLv2:!SSLv3
Or is it better to list individual ciphers for SSLCipherSuite
?
SSLCipherSuite ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:RC4-SHA ...
Are both keywords fundamentally different in what they configure? I have this feeling I am overlooking something essential here.
Above configurations are not necessarily good practice, they're just an example to explain my doubt.
Asked by jippie
(14566 rep)
Mar 23, 2015, 05:39 PM
Last activity: Apr 21, 2025, 02:02 PM
Last activity: Apr 21, 2025, 02:02 PM