问题
I'm a non-technical-but-able-to-read-the-manual website owner. I am running Apache 2.4.10 on a Debian 9.0 server. I would like to disable TLS 1.0. I have read the Apache documentation for the SSLProtocol directive.
In my virtual host file, I used the following directive:
SSLProtocol all -TLSv1 -SSLv3
That didn't work, even after reloading and then restarting Apache. I then added the same directive to the ssl.conf file as well, just to be sure, and still no luck, even after reloading and restarting. I also tried the same things with the following directive:
SSLProtocol +TLSv1.1 +TLSv1.2
Still no luck. I did the following search just to see if I had used the SSLProtocol directive somewhere else in my configuration files, but again, no luck:
grep -R 'SSLProtocol' .
I also checked the .htaccess file for the website to make sure I hadn't overridden anything (though I don't know that you could change this setting in an .htaccess file). Any ideas? Thank you for your help!
回答1:
In a large amount of cases for this "bug" it turns out that if you have letsencrypt installed on your server, it's configuration file sets protocols which are superseding ssl.conf or vhosts' settings:
/etc/letsencrypt/options-ssl-apache.conf
Bug 60739 - SSLProtocol settings seem to have no effect
回答2:
There is an answer for this questions here:
How to disable TLS 1.1 & 1.2 in Apache?
Basically, you have to disable this protocol in the ssl.conf file. Doing that in your vhosts.conf or equivalent file will not work (although it is right setting this configuration there), due a bug in OpenSSL, as reported in one of the answers cited there.
回答3:
As of today, 11/15/2018, there is a known bug about failing to disable tls1.0 in Apache 2.4. So don't hit your head when your modification just didn't work for no reason. Hopefully we can get it patched soon.
Also form the ticket
This seem to have changed somewhere between 2.4.18 + 2.4.23 as setting SSLProtocol use to be honored.
来源：https://stackoverflow.com/questions/43437546/disabling-tls-1-0-in-apache-2-4