Cfrtjryk

I'm trying to pass a vulnerability scan for my CentOS 6.9 server. The last of the issues I am attempting to resolve relate to the use of outdated SSL protocols. When I attempt to use the following line in my ssl.conf

SSLProtocol -all +TLSv1.1

and then run a configest

service httpd24-httpd configtest

I am presented with the error

SSLProtocol: Illegal protocol 'TLSv1.1'

I've narrowed this down to possibly an outdated version of OpenSSL. When I began this process I was on the version OpenSSL 1.0.1e-fips 11 Feb 2013 and I've updated that to a more recent version by following these instructions: http://www.ehowstuff.com/how-to-install-and-update-openssl-on-centos-6-centos-7/

Now when I check the version I get OpenSSL 1.0.2l 25 May 2017 however I still get the same error during the configtest. I'm thinking at this point that the mod_ssl.so file in apache needs to be upgraded but I am sort of at a loss for my next steps (I'm a little out of my depth at this point). Since I downloaded httpd24 as a package I never had to compile it and I'm not sure of where to go next. As far as I understand, it's possible to include a new mod_ssl.so without recompiling Apache, but in practice I don't know how I'd go about that.

Had the same problem just now. Comparing differences between a couple of servers I realised the one having the issues did not have mod_ssl installed somehow.

yum install mod_ssl

fixed this problem for me.