News for hackers. Stuff that matters.

A comment on This POODLE bites: exploiting the SSL 3.0 fallback.

Re:This POODLE bites: exploiting the SSL 3.0 fallback by AbeEstrada on Tuesday October 14, 2014 @09:44PM (#8456816)
Disable SSLv2 and SSLv3

For Apache:

SSLProtocol all -SSLv2 -SSLv3

For Nginx:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

Source: http://blog.rlove.org/2013/12/strong-ssl-crypto.html

[ Parent | on HN ]
Re:This POODLE bites: exploiting the SSL 3.0 fallback by ecaron on Wednesday October 15, 2014 @01:11AM (#8457255)
For any unfortunate souls using IIS, Digicert has a walkthrough of disabling SSLv3 at https://www.digicert.com/ssl-support/iis-disabling-ssl-v3.ht...
[ Parent | on HN ]
Re:This POODLE bites: exploiting the SSL 3.0 fallback by budgi3 on Wednesday October 15, 2014 @04:17AM (#8457574)
For IIS:

Nartac IIS Crypto gives a nice GUI to manage all Protocols, Ciphers, Hashes and Key Exchanges https://www.nartac.com/Products/IISCrypto/

[ Parent | on HN ]