On 04/28/2014 12:02 PM, Joseph wrote: > > I'm using apache-2.2.25 > Which file contain setting for: SSLCompression > I'm trying to turn it off. >
It's on by default in apache-2.2. Place the following somewhere in 40_mod_ssl.conf, between "<IfModule ssl_module>" and "</IfModule>": # Disable CRIME attack (off by default in apache-2.4) SSLCompression off
