Apache上的SSL配置

Question

我有一个带有OpenSSL/1.0.1s的Apache/2.4.18服务器。我使用Mozilla SSL配置生成器生成SSL：

SSLProtocol             all -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

SSL实验室测试给出了以下消息：

The server supports only older protocols, but not the current best TLS 1.2. Grade capped to C.
The server does not support Forward Secrecy with the reference browsers.

此外，在“握手模拟”中，它给出了这样的信息：

Apple ATS 9 / iOS 9  R  Server sent fatal alert: handshake_failure

我如何摆脱这些问题，特别是最后一个问题，以便iOS 9用户能够毫无问题地进行连接？

谢谢!

Answer 1

我建议使用以下工具测试您的站点：https://www.ssllabs.com/ssltest/ https://ssl-tools.net/

它们将为您提供关于您的服务器是否设置正确的重要见解，并提供链接以使事情变得更好。