Home / server / Questions / 184230
Accepted
Roy
Asked: 2010-09-24 23:42:51 +0800 CST

Apache mod_ssl configuration for PCI compliance

  • 772

I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid:

SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM

What should the SSLCipherSuite configuration look like to completely disable SSLv2 and meet the PCI requirements?

apache-2.2 ssl pci-dss

3 Answers

  1. Best Answer

    This is what I currently use for a PCI compliant Apache configuration:

    SSLProtocol all -SSLv2
SSLCipherSuite ALL:!EXP:!NULL:!ADH:!LOW
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
    • 3

  2. If you have Apache 2.0+ you can avoid the rewrite rules that Warner mentioned and replace them with just:

    TraceEnable Off
    • 3

  3. The protocols can be disabled with the SSLProtocol statement as such:

    SSLProtocol -ALL +SSLv3 +TLSv1
    • 1