Tâche #11329
Distribution EOLE - Scénario #10951: Désactiver le protocole SSLv3 sur les services web
Désactiver le SSLv3 sur EoleSSO
Status:
Fermé
Priority:
Normal
Assigned To:
Target version:
Remaining (hours):
0.0
Related issues
Associated revisions
History
#1 Updated by Joël Cuissinat about 8 years ago
- Parent task set to #10951
#2 Updated by Laurent Flori about 8 years ago
- Assigned To set to Laurent Flori
#3 Updated by Laurent Flori about 8 years ago
- Status changed from Nouveau to En cours
#4 Updated by Joël Cuissinat about 8 years ago
- % Done changed from 0 to 100
- Remaining (hours) changed from 2.0 to 0.25
#5 Updated by Joël Cuissinat about 8 years ago
- Status changed from En cours to Résolu
#6 Updated by Daniel Dehennin about 8 years ago
- Status changed from Résolu to Fermé
- Remaining (hours) changed from 0.25 to 0.0
Ok avec eole-sso version 2.4.1-10 en eole-2.4.1-proposed-updates
gnutls-cli-debug -p 8443 scribe.ac-test.fr
Warning: getservbyport(8443) failed. Using port number as service.
GnuTLS debug client 3.3.15
Checking scribe.ac-test.fr:8443
for SSL 3.0 (RFC6101) support... no
whether we need to disable TLS 1.2... no
whether we need to disable TLS 1.1... no
whether we need to disable TLS 1.0... no
whether %NO_EXTENSIONS is required... no
whether %COMPAT is required... no
for TLS 1.0 (RFC2246) support... yes
for TLS 1.1 (RFC4346) support... no
fallback from TLS 1.1 to... TLS 1.0
for TLS 1.2 (RFC5246) support... no
for certificate chain order... sorted
for safe renegotiation (RFC5746) support... yes
for heartbeat (RFC6520) support... no
for version rollback bug in RSA PMS... no
for version rollback bug in Client Hello... no
whether the server ignores the RSA PMS version... no
whether small records (512 bytes) are accepted... yes
whether cipher suites not in SSL 3.0 spec are accepted... yes
whether a bogus TLS record version in the client hello is accepted... yes
whether the server understands TLS closure alerts... no
whether the server supports session resumption... no
for anonymous authentication support... no
for ephemeral Diffie-Hellman support... no
for ephemeral EC Diffie-Hellman support... no
for AES-128-GCM cipher (RFC5288) support... no
for AES-128-CBC cipher (RFC3268) support... yes
for CAMELLIA-128-GCM cipher (RFC6367) support... no
for CAMELLIA-128-CBC cipher (RFC5932) support... yes
for 3DES-CBC cipher (RFC2246) support... yes
for ARCFOUR 128 cipher (RFC2246) support... yes
for MD5 MAC support... no
for SHA1 MAC support... yes
for SHA256 MAC support... no
for ZLIB compression support... no
for max record size (RFC6066) support... no
for OCSP status response (RFC6066) support... no
for OpenPGP authentication (RFC6091) support... no
NB: le SSLv3 est désactivé mais j’ai un doute sur le 3DES-CBC.