It has come to my attention that my SSL security could be better. I need to change my SSL ciphers to the latest recommendation. I was expecting to find them in /etc/apache2/sites-enabled/*.conf in a virtualhost but I didn’t. This is what I have
SSLEngine on
SSLCertificateFile /home/egcw/domains/domain.com/ssl.cert
SSLCertificateKeyFile /home/egcw/domains/domain.com/ssl.key
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCACertificateFile /home/egcw/domains/domain.com/ssl.ca
There is no mention of SSL ciphers. I also checked many other .conf files in apache2/ but didn’t find it.
I could add my ciphers here but I would like to update them for all the domains and if there is a common place where they virtualmin puts them, I’d like to know about it. I have dozens of domains on the server and manually editing each virtualhost will take hours.
@stefan1959, don’t get me wrong, but in which way your response helps here?
I’m not aware of a common spot for the config that then applies to all domains - but stand corrected if there is.
If it’s only a handful of domains, just add SSLCipherSuite HIGH:!aNULL underneath the SSL lines and you should be ready to go. Don’t forget to restart your web server.
All my websites are sporting A+ ratings but never show all bars to hit 100%. However, I still can’t figure how this should help with the original request…
Many, many moons ago, I put mine there but it had no effect on the websites. After I stored it in the respective conf file, it showed effect. Hence, I reckon there’s no central conf file that would serve as a master template for website configs.
@stefan1959 Each domain has its own ratings. My domains are on B rating. This server was setup 4 years ago and I’m guessing the ciphers are the best recommendation of that time and never updated.
I’d like to know how virtualmin is setup for this? Because normally SSLCipher is not skipped in apache configs. The fact the virtualmin is not putting them in servers it creates, there must be a reason for that. Of course there are defaults loading from somewhere. Where though? Calling virtualmin staff!
This is a configuration that I use for all of my websites (all A+ rated on SSLLabs). Have a look and see where discrepancies resp. room for improvement are: