Topic: Enabling Secure Client-Initiated Renegotiation

[gijs]

I'd like to use Secure Client-Initiated Renegotiation on my Apache server but according to SSL-labs it's currently (by default?) disabled.

How can I enable this? Why is this not enabled by default?

https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Secure_Renegotiations

[James Blond]

You need a new OpenSSL Version I guess.
this is my current apache config with the last OpenSSL Version which works. https://gist.github.com/JBlond/a60ff12944c28d0b6349

That is by default see https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslinsecurerenegotiation

Maybe your Apache version is not the last version?

[gijs]

I'm using Apache 2.4.18 from this PPA: https://launchpad.net/~ondrej/+archive/ubuntu/apache2 on Ubuntu 15.10

SSL labs reports:
Secure Renegotiation Supported
Secure Client-Initiated Renegotiation No
Insecure Client-Initiated Renegotiation No

[gijs]

I've checked the openssl version which appears to be:
OpenSSL 1.0.2g 1 Mar 2016

Another thing I've noticed is that next protocol negotiation appears to be disabled according to ssllabs.

Although the site also reports that some browsers(e.g. edge, firefox and chrome) use H2. (TLS 1.2 > h2)
IE11 reports: TLS 1.2 > http/1.1