Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • There are a couple of problems with your solution: 1. you are not changing the protocol settings, but the list of ciphersuites (MinProtocol and MaxProtocol changes the protocols), 2. you are changing the default configuration of all software using OpenSSL, not just the settings of the proxy connection, 3. most software (including Apache2) always override these default settings. For Apache2 see the SSLProxyProtocol directive. Commented Nov 2, 2021 at 21:21
  • 1
    Well when I upgraded from Ubuntu 18 to 20 this worked out of the box. And I didn't have to change anything in my Apache conf. And also curl started to work (and before this change it reported "unsuported protocol"). So it does change supported protocol versions. But yes, you are right that the change is global.
    – Nux
    Commented Nov 2, 2021 at 22:21
  • I checked and I have default settings for proxy protocol so SSLProxyProtocol all -SSLv3 so that would include TLS1.0. And still connecting to tls1 server didn't work from Ubuntu 20.
    – Nux
    Commented Nov 2, 2021 at 23:08
  • 2
    I wrongly assumed Ubuntu's and Debian's openssl packages are in sync. Whereas Debian chose to add a MinProtocol default to openssl.cnf, Ubuntu chose a more drastic solution and hardcoded a minimum version of 1.2 into security level 2. Commented Nov 4, 2021 at 21:21