• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Resolved Plesk 12 standart SSL crypt is bad

Status
Not open for further replies.
O

omexlu12

Basic Pleskian
Hello,

I have make some SSL-test (https://www.ssllabs.com/ssltest) and it shows me that not all is perfect.
But i use plesk in standart-configuration how can i secure better the SSL connection, and why plesk don't use this config as default?

show.png

Thanks in advance.
 
Hi omexlu12,

There are cipher lists provided in the above link, or you can use the one recommended by Qualys.

Configuring Apache, Nginx, and OpenSSL for Forward Secrecy

Nginx
Code: 
ssl_ciphers   EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

Apache
Code: 
SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS

I hope that helps
Kind regards

Lloyd
 
Last edited:
Hi @Lloyd_mcse ,

Sry i am not so the linux expert.

I have open now the /etc/apache2/mods-avaible/ssl.conf and have added -SSLv3 to the section, than i have do a restart of apache but the same problem.

Where can i define the ssl_ciphers? i don't have ssl_ciphers in apache2.conf or ssl.conf

Thanks in advance.

EDIT: I have Apache with nginx combination need to change at the 2 places?
 
Last edited:
@Lloyd_mcse

Thank you, in detail i must to that now:

edit /etc/apache2/mods-avaible/ssl.conf

Change the line to that:
SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
Click to expand...

add to protocol -SSLv3:
SSLProtocol all -SSLv2 -SSLv3
Click to expand...

Then restart the apache ?

I have apache + nginx combination need to change at the 2 files?

This is my ssl.conf at this point:
<IfModule mod_ssl.c>
#
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
#
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512

##
## SSL Global Context
##
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
##

#
# Some MIME-types for downloading Certificates and CRLs
#
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl

# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin

# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
# (The mechanism dbm has known memory leaks and should not be used).
#SSLSessionCache dbm:${APACHE_RUN_DIR}/ssl_scache
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300

# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
SSLMutex file:${APACHE_RUN_DIR}/ssl_mutex

# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. See the
# ciphers(1) man page from the openssl package for list of all available
# options.
# Enable only secure ciphers:
#SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS

# Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.),
# you might want to force clients to specific, performance
# optimized ciphers. In this case, prepend those ciphers
# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
# Caveat: by giving precedence to RC4-SHA and AES128-SHA
# (as in the example below), most connections will no longer
# have perfect forward secrecy - if the server's key is
# compromised, captures of past or future traffic must be
# considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
SSLHonorCipherOrder on

# enable only secure protocols: SSLv3 and TLSv1, but not SSLv2
SSLProtocol all -SSLv2 -SSLv3

# Allow insecure renegotiation with clients which do not yet support the
# secure renegotiation protocol. Default: Off
#SSLInsecureRenegotiation on

# Whether to forbid non-SNI clients to access name based virtual hosts.
# Default: Off
#SSLStrictSNIVHostCheck On

</IfModule>
Click to expand...

Edit: after this changes and apache restart nothing changes.
 
Last edited:
Yeah, that's it.
Since you have Nginx to, you will need to edit the templates as described in the link in my first post....
Code: 
# mkdir -p /usr/local/psa/admin/conf/templates/custom/
# mkdir -p /usr/local/psa/admin/conf/templates/custom/server/
# mkdir -p /usr/local/psa/admin/conf/templates/custom/domain/
# cp /usr/local/psa/admin/conf/templates/default/nginxWebmailPartial.php  /usr/local/psa/admin/conf/templates/custom/
# cp /usr/local/psa/admin/conf/templates/default/domain/nginxDomainVirtualHost.php /usr/local/psa/admin/conf/templates/custom/domain/
# cp /usr/local/psa/admin/conf/templates/default/server/nginxVhosts.php /usr/local/psa/admin/conf/templates/custom/server/

Once you have done that you can edit the files in the custom folder, adding the protocols and ciphers you want.

And then reconfigure all domains with
Code: 
# /usr/local/psa/admin/bin/httpdmng --reconfigure-all

I hope that helps
Kind regards

Lloyd
 
Hi omexlu12,
sorry for the delay in getting back to you.
Yes you can generate a larger DH with...
Code: 
# openssl dhparam -out /etc/ssl/RSA2048.pem -5 2048


and then add it to the Nginx templates as before.
Code: 
ssl_dhparam    /etc/ssl/RSA2048.pem;


Kind regards

Lloyd
 
@Lloyd_mcse

Has working less problems :)
show.png

But give me only A (this is very good) but not A+

I have the following that is orange at this point:

show1.png show2.png

Can i do something there?

Thanks a lot for helping.
 
Hi omexlu12,

That's better :)

Chain Issues means you have added the final Root CA in the CA Text box, you only need to add the intermediate.
It should be labelled as Intermediate CA really.

The session resumption, is an easy fix, you can add it in the Templates as before...
Code: 
ssl_session_cache                  shared:SSL:5m;

You'll notice there is another "ssl_session" entry, so you can add it under that.

If you want A+ you'll have to add HSTS to your sites "Additional Nginx Directives" in the panel, with...
Code: 
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

But that will mean you can only access your site via https.
I think that covers everything
Kind regards

Lloyd
 
Hi omexlu12,
You need to go to...

Plesk -> Domains -> yourdomain.tld -> Web Server Settings
Click to expand...

You'll see a box for additional HTTP Directives, one for HTTPS and at the bottom the Additional Nginx Directives box.
Depending on your configuration add either the Apache or Nginx version of the HSTS Directive...

Apache (Additional directives for HTTPS)
Code: 
#Apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Or

Nginx
Code: 
# Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

Let us know how you get on.
Kind regards

Lloyd
 
@Lloyd_mcse

I have to the following
cp /usr/local/psa/admin/conf/templates/default/nginxDomainWebmail.php /usr/local/psa/admin/conf/templates/custom/
cp /usr/local/psa/admin/conf/templates/default/domainWebmail.php /usr/local/psa/admin/conf/templates/custom/
Click to expand...


edit the files:
Bildschirmfoto vom 2015-06-04 22:25:51.png Bildschirmfoto vom 2015-06-04 22:26:23.png

/usr/local/psa/admin/bin/httpdmng --reconfigure-all
Click to expand...

But nothing has changed? forgot something?
 
Last edited:
omexlu12 said:
@Lloyd_mcse

Thanks for your Answer, which files need to be changed? (apache and nginx)
I really don't understand what to do.

These templates?
domainWebmail.php
nginxDomainWebmail.php

Thanks in advance.
Click to expand...

Hi omexlu12,

please be so kind, to ask your corresponding questions for your webmail - issue in the mentioned thread from Lloyd_mcse, so that other users and search robots will find questions and solutions in the corresponding threads - threads with multiple issues and/or questions could confuse forum users and will lead in a lot of search results, which have nothing to do with the initial post of a thread.
 
Status
Not open for further replies.

Similar threads

D
Issue certificate of VPS host still used after SSL configuration for newly added domain
Replies
4
Views
690
deepnpisgah
D
W
Resolved SSL certificate error (multiple certificates)
Replies
9
Views
3K
webolot
W
P
Resolved Can't accessing Plesk log in page over HTTPS
Replies
4
Views
130
Patashoow
P
D
Issue Can't enable TLSv1 and TLSv1.1 on Ubuntu 22.04
Replies
4
Views
5K
omniscient
O
M
Resolved Cannot install or retrieve license key
2
Replies
22
Views
10K
mazo0012
M
Back
Top