# How to deny the SSL v2.0 handshake when SSL v2.0 is disabled

**URL:** <https://www.ruby-forum.com/t/how-to-deny-the-ssl-v2-0-handshake-when-ssl-v2-0-is-disabled/190926>\
**Category:** NGINX\
**Created:** [June 30, 2010, 10:25pm UTC](https://www.ruby-forum.com/t/how-to-deny-the-ssl-v2-0-handshake-when-ssl-v2-0-is-disabled/190926 "2010-06-30T22:25:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Calomel\_Org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@Calomel\_Org](https://www.ruby-forum.com/u/Calomel_Org)\
**Post date:** [June 30, 2010, 10:25pm UTC](https://www.ruby-forum.com/t/how-to-deny-the-ssl-v2-0-handshake-when-ssl-v2-0-is-disabled/190926/1 "2010-06-30T22:25:18Z")

</div>

Is there any way to completely disable the SSL v2.0 handshake when SSL  
v2.0 support is disabled in nginx.conf ?

This is the SSL configuration used and only TLSv1 is enabled in  
“ssl\_protocols”.

## Nginx SSL (FIPS 140-2 experimental)

ssl on;  
ssl\_certificate /ssl\_keys/host.org\_ssl.crt;  
ssl\_certificate\_key /ssl\_keys/host\_ssl.key;  
ssl\_ciphers  
DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA;  
ssl\_dhparam /ssl\_keys/host\_dh.pem;  
ssl\_prefer\_server\_ciphers on;  
ssl\_protocols TLSv1;  
ssl\_session\_cache shared:SSL:10m;  
ssl\_session\_timeout 5m;

The reason this question has come up is SSL Labs has recently been in  
the news promoting a tool to check the compliance of a SSL server. We  
thought we would check our host and we ranked at the very top (93%) of  
the “Recent Best-Rated”. The testing site can be found here:

[SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssldb/index.html)

When we checked our server ([https://calomel.org](https://calomel.org)) with their tool it  
reported “SSL 2.0+ Upgrade Support” was enabled. We used the OpenSSL  
binary on the command line and found SSLv2 and SSLv3 are definitely  
turned off as Nginx denied the use of these protocols. Only TLSv1 was  
allowed.

The problem is the SSLv2 upgrade support handshake is somehow accepted  
according to SSL Labs. I am not sure how to verify this handshake  
myself.

According to SSL Labs “SSL 2.0+ Upgrade Support” means, “…the server  
supports SSLv2 handshake, even though it may not support SSLv2 itself.  
Essentially it’s an optimization. Instead of a client first requesting  
SSLv2 (with a SSLv2 handshake) and failing (if the server does not  
support it), then having to request SSLv3 or better (with a SSLv3  
handshake), the client can use the SSLv2 handshake to indicate support  
for newer protocols.” The full news group thread containing this quote  
can be found at:

[http://sourceforge.net/mailarchive/forum.php?thread\_name=20100629171623.43012oj4b2hgrzi8%40webmail.mxes.net&forum\_name=ssllabs-discuss](http://sourceforge.net/mailarchive/forum.php?thread_name=20100629171623.43012oj4b2hgrzi8%40webmail.mxes.net&forum_name=ssllabs-discuss)

Lastly, in order for a server to be considered “FIPS 140-2 Compliant”  
it must not respond to any SSLv2 or SSLv3 protocol requests. Only  
TLSv1 (version 1.0 to 1.2) are accepted.

We appreciate any help, suggestions or clarification.

–  
Calomel @ [https://calomel.org](https://calomel.org)  
Open Source Research and Reference

---

<div class="post-metadata">

**Author:** ![Calomel\_Org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@Calomel\_Org](https://www.ruby-forum.com/u/Calomel_Org)\
**Post date:** [July 1, 2010, 7:26am UTC](https://www.ruby-forum.com/t/how-to-deny-the-ssl-v2-0-handshake-when-ssl-v2-0-is-disabled/190926/2 "2010-07-01T07:26:41Z")

</div>

On Wed, Jun 30, 2010 at 04:21:25PM -0400, Calomel Org wrote:

> ssl\_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA;
> 
> myself.  
> [http://sourceforge.net/mailarchive/forum.php?thread\_name=20100629171623.43012oj4b2hgrzi8%40webmail.mxes.net&forum\_name=ssllabs-discuss](http://sourceforge.net/mailarchive/forum.php?thread_name=20100629171623.43012oj4b2hgrzi8%40webmail.mxes.net&forum_name=ssllabs-discuss)
> 
> Lastly, in order for a server to be considered “FIPS 140-2 Compliant”  
> it must not respond to any SSLv2 or SSLv3 protocol requests. Only  
> TLSv1 (version 1.0 to 1.2) are accepted.
> 
> We appreciate any help, suggestions or clarification.

As I understand OpenSSL sources it disables SSL 2.0+ upgrade support,  
only if FIPS is enabled. If you built OpenSSL with FIPS support,  
then add in openssl.cnf:

openssl\_conf = openssl\_options

[openssl\_options]  
alg\_section = algs

[algs]  
fips\_mode = yes

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![Calomel\_Org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@Calomel\_Org](https://www.ruby-forum.com/u/Calomel_Org)\
**Post date:** [July 1, 2010, 5:10pm UTC](https://www.ruby-forum.com/t/how-to-deny-the-ssl-v2-0-handshake-when-ssl-v2-0-is-disabled/190926/3 "2010-07-01T17:10:21Z")

</div>

Thank you Igor! Building OpenSSL with FIPS support disabled the SSLv2  
upgrade handshake and the tests passed.

[https://www.ssllabs.com/ssldb/analyze.html?d=calomel.org](https://www.ssllabs.com/ssldb/analyze.html?d=calomel.org)

Thanks again for the suggestion.

–  
Calomel @ [https://calomel.org](https://calomel.org)  
Open Source Research and Reference