How to enable the old TLS 1.0 and TLS 1.1 on Apache on Ubuntu 20.04

user_2882705 0
Viewed 4447

Summary: We need to re-enable old TLS 1.0 / TLS 1.1 on Apache on Ubuntu 20.04 to support old application.

Background: We have recently upgraded from Ubuntu 18.04 to 20.04. One of our old Windows application has stopped working. We have diagnosed the problem down to our new server not accepting TLS 1.0 / 1.1 connections. How can we re-enable these old protocols? We know these are less secure but that serves our purpose right now.

We have tried adding SSLProtocol +TLSv1 +TLSv1.1 to the Apache config but it does not work.

Please help.

tls1.2 openssl ubuntu ssl apache
2 Answers

You should try to specify SSLCipherSuite with an extra @SECLEVEL=1 pseudo-protocol. The default security level in Ubuntu 20.04 will not allow to use TLSv1 even if you explicitly set it in the supported protocols list.

Try:

SSLEngine on
SSLProtocol all
SSLCipherSuite ALL:@SECLEVEL=1
user_12470920

The thing that eventually works for me is replacing

SSLCipherSuite HIGH:!aNULL

with

SSLCipherSuite TLSv1:@SECLEVEL=1

in /etc/apache2/mods-avalable/ssl.conf

The SSLProtocol lines had no effect for me, although they might work if they are put in the first vhost configuration that Apache encounters.

user_31184010
Related