For maximum security, verify the correct use of cipher suites in Apache httpd.

1

To verify the correct use of cipher suites in Apache httpd, run the grep SSLCipherSuite /usr/lib/vmware-vcopssuite/utilities/conf/vcops-apache.conf | grep -v '#' command from the command prompt.

If Apache httpd uses the correct cipher suites, the command returns the following output: SSLCipherSuite kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:!aNULL!ADH:!EXP:!MD5:!3DES:!CAMELLIA:!PSK:!SRP:!DH

2

To configure the correct use of cipher suites, run the sed -i "/^[^#]*SSLCipherSuite/ c\SSLCipherSuite kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:\!aNULL\!ADH:\!EXP:\!MD5:\!3DES:\!CAMELLIA:\!PSK:\!SRP:\!DH" /usr/lib/vmware-vcopssuite/utilities/conf/vcops-apache.conf command from the command prompt.

Run this command if the output in Step 1 is not as expected.

This command disables all cipher suites that use DH and DHE key exchange methods.

3

Run the /etc/init.d/apache2 restart command from the command prompt to restart the Apache2 server.

4

To reenable DH, remove !DH from the cipher suites by running the sed -i "/^[^#]*SSLCipherSuite/ c\SSLCipherSuite kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:\!aNULL\!ADH:\!EXP:\!MD5:\!3DES:\!CAMELLIA:\!PSK:\!SRP" /usr/lib/vmware-vcopssuite/utilities/conf/vcops-apache.conf command from the command prompt.

5

Run the /etc/init.d/apache2 restart command from the command prompt to restart the Apache2 server.