On Monday, 29 April 2019 13:22:56 CEST Olaf Zaplinski wrote: > I have set > SSLCipherSuite "-ALL ECDHE-ECDSA-CHACHA20-POLY1305 > ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES256-GCM-SHA384" in > mods-enabled/ssl.conf > > SSLProtocol is not defined anywhere. SSLCipherSuite is only defined here. > > According to Qualsys SSL labs test, non-defined ciphers are being used, e.g. > ECDHE-RSA-AES128-GCM-SHA256 > > Expectation: only defined three ciphers are being used.
apache2 in stretch still uses openssl 1.0 libs, while the command line utility is already 1.1. This makes it difficult to check with "openssl ciphers" what is actually happening. openssl 1.0 does not support the chacha ciphers. But I don't know why apache does not complain about the unknown ciphers. Probably that's a bug. In buster / Debian 10, this seems to work better, because there apache2 links against openssl 1.1. But even there, things are weird. It does not seem possible to select a single cipher: $ openssl ciphers ECDHE-RSA-AES256-GCM-SHA384 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE- RSA-AES256-GCM-SHA384