Question

标题

Apache / 2.2.31（Unix）

我在许多虚拟主机部分之外进行了SSL配置：

SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCompression Off
SSLCipherSuite "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA25$
SSLProxyProtocol +TLSv1.2 -SSLv2 -SSLv3

然后我有一个具有以下代理配置的虚拟主机：

RewriteEngine On
SSLProxyEngine On
RewriteCond %{QUERY_STRING} !(^|&)requestOrigin=apiGateway($|&) [NC]
RewriteRule ^/portal/mobile/stores$ https://xxx.execute-api.eu-west-1.amazonaws.com/test/stores [QSA,P,L]

正如您所看到的，我已经重写了将原始请求代理到Amazon API网关的规则。 Amazon API网关不支持SSLv3，这就是我在上述配置中禁用它的原因。我希望TLSv1.2用于代理。

但是，上面配置禁用SSL的apache仍使用SSL连接到amazon。请参阅下面的调试输出：

[debug] ssl_engine_io.c(1090): [client XXX.XXX.XXX.XXX] SNI extension for SSL Proxy request set to 'example.com'
[debug] ssl_engine_kernel.c(1834): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: before/connect initialization
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write client hello A
[debug] ssl_engine_io.c(1939): OpenSSL: read 5/5 bytes from BIO#10c87d0 [mem: 10cttb3] (BIO dump follows)
[debug] ssl_engine_io.c(1872): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1911): | 0000: 16 02 02 00 02                                   .....            |
[debug] ssl_engine_io.c(1917): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1939): OpenSSL: read 2/2 bytes from BIO#10c87d0 [mem: 10c44b8] (BIO dump follows)
[debug] ssl_engine_io.c(1872): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1911): | 0000: 02 38                                            .(               |
[debug] ssl_engine_io.c(1917): +-------------------------------------------------------------------------+
[debug] ssl_engine_kernel.c(1847): OpenSSL: Read: SSLv3 read server hello A
[debug] ssl_engine_kernel.c(1866): OpenSSL: Exit: failed in SSLv3 read server hello A
[info] [client XXX.XXX.XXX.XXX] SSL Proxy connect failed

为什么apache代理仍然使用SSL3进行代理？如何一劳永逸地禁用它？

Answer 1

尝试更改

<强> SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 -SSLv2 -SSLv3

到

<强> SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2

并改变

<强> SSLProxyProtocol +TLSv1.2 -SSLv2 -SSLv3

到

<强> SSLProxyProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2

Apache - 使用SSLProxyProtocol禁用SSLv3 - 无法正常工作

标题

1 个答案: