Blog | G5 Cyber Security

SSL Certificate Protocol Control

G5 Cyber Security

TL;DR

Yes, an SSL certificate can dictate which protocols are used for a secure connection (like HTTPS). It’s not the certificate itself directly, but how it’s configured on your web server. You need to ensure your server supports and prioritises the protocols allowed by the certificate authority (CA) and disable older, insecure ones like SSLv3 or TLS 1.0.

How SSL Certificates Influence Protocol Use

SSL/TLS certificates don’t directly *force* a specific protocol. Instead, they are used in conjunction with your web server’s configuration to establish secure connections using supported protocols. The server decides which protocol to use based on the client’s capabilities and its own settings.

Steps to Control Protocols

  1. Check Your Certificate Details: First, understand what protocols your certificate supports. This information is usually available from your CA’s documentation or when you download the certificate.
  2. Configure Your Web Server: The main control lies in your web server’s settings (Apache, Nginx, IIS, etc.). You need to explicitly enable and disable TLS versions.
    • Apache: Edit your virtual host configuration file (e.g., /etc/apache2/sites-available/your_site.conf). Use the SSLProtocol directive: 
      SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On

      This example disables SSLv3 and TLS 1.0/1.1, keeping only TLS 1.2 and higher enabled.

    • Nginx: Edit your server block configuration file (e.g., /etc/nginx/sites-available/your_site). Use the ssl_protocols directive: 
      ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

      This example enables only TLS 1.2 and 1.3.

    • IIS: Use the IIS Manager. Navigate to Server Certificates, select your certificate, then configure SSL settings in the Binding options. You can choose minimum TLS version there.
  3. Cipher Suite Selection: Along with protocols, cipher suites determine encryption algorithms used. Configure strong cipher suites and disable weak ones.
    • Apache: Use SSLCipherSuite directive: 
      SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:...
    • Nginx: Use ssl_ciphers directive: 
      ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:...';
  4. Restart Your Web Server: After making changes, restart your web server for the new configuration to take effect. 
    sudo systemctl restart apache2  # For Apache on Debian/Ubuntu
sudo systemctl restart nginx   # For Nginx on Debian/Ubuntu
iisreset                         # For IIS on Windows
  5. Test Your Configuration: Use online SSL testing tools (like SSL Labs) to verify your server’s protocol and cipher suite support.
    • These tools will show you which protocols are enabled, any vulnerabilities, and the strength of your configuration.

Important Considerations

Exit mobile version