Bug#1109839: apache2: in ssl.conf, SSLProtocol has a duplicate "all"

Daniel Lewart <[email protected]> Thu, 31 Jul 2025 00:00:00 -0500

Newsgroups	gmane.linux.debian.devel.apache
Message-ID	<CALE_k2EP04hTwFuPCkqPtzEXtLoUbHLJ7C+9PKoeB9QGtyuDdg__45042.1536270127$1753938085$gmane$org@mail.gmail.com>

Vincent, Bastian, et al,

On Thu, 24 Jul 2025 22:00:33 +0200, Vincent Lefevre wrote:

> In the /etc/apache2/mods-available/ssl.conf file:
>
> #   The protocols to enable.
> #   Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
> #   SSL v2  is no longer supported
> SSLProtocol all all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
>
> "all" appears twice.
>
> BTW, I suppose that -SSLv2 could be removed since SSLv2 is no longer
> an available value.

On Tue, 29 Jul 2025 20:34:13 +0000, Bastien Roucariès wrote:

>    * Fix SSLProtocol has a duplicate "all"
>      (Closes: #1109839)

A better patch is in Message #31 of the following:
    #943415 - apache2: Disable TLS 1.0 and 1.1 by default:
        https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=943415

Thank you!
Daniel Lewart
Urbana, Illinois