[openssl-users] Disable SSL3 and enable TLS1? / Ambiguous "DES-CBC3-SHA"
drueter at assyst.com
Tue Apr 7 00:11:22 UTC 2015
I would like to disable SSL3 (to prevent POODLE attacks), but I would like
to leave TLS1 enabled (particularly DES-CBC3-SHA, AES128-SHA and
However disabling SSL3 with !SSLv3 disables TLSv1 also. Furthermore,
disabling SSL3 with -SSLv3 then adding in individual ciphers such as
+DES-CBC3-SHA seems to re-enable SSLv3.
In looking at https://www.openssl.org/docs/apps/ciphers.html it looks like
SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA are both
referred to as DES-CBC3-SHA.
Is this intentional? Are not SSL_RSA_WITH_3DES_EDE_CBC_SHA and
TLS_RSA_WITH_3DES_EDE_CBC_SHA different ciphers?
Is there no way to disable SSL3 while leaving TLS_RSA_WITH_3DES_EDE_CBC_SHA
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the openssl-users