Cdtjkyj

I am running Apache2 version:

Server version: Apache/2.4.29 (Ubuntu)

Server built:   2018-04-25T11:38:24

I would like to enable TLSv1.3 but I get an error below in Apache2 if I put SSLProtocol TLSv1.2 TLSv1.3 in the ssl.conf file:

# apachectl configtest



AH00526: Syntax error on line 79 of /etc/apache2/mods-enabled/ssl.conf:

SSLProtocol: Illegal protocol 'TLSv1.3'

Action 'configtest' failed.

The Apache error log may have more information.

Is it not possible to enable TLSv1.3 in Apache2 (yet)?

I know Nginx can do it, but this question aims at Apache2.

TLSv1.3 is not yet supported by Apache 2.4.

When it is supported by OpenSSL (see info here), Apache 2.4 should have it too.

TLSv1.3 is now supported in Apache2 version 2.4.36 with OpenSSL 1.1.1 Source.

As for TLS 1.3, as was pointed out in this answer, it is still a work in progress, not yet in production in Apache2.

As TLS 1.3 has been finally accepted IETF, it is probably going to production very soon. See their blog for some basic information.

Notes, too long for a comment:

• 
  

  
  

  HTTP SITE DOES NOT REDIRECT

  
  

  
  
  

  The HTTP version of the website does not redirect to the HTTPS version. We advise to enable redirection.

  
  
  

  You can follow this answer on Webmasters. It includes tips for the HSTS Preload list, which after some modifications, you should add the site into.

  
  


• 
  

  Your ciphers are wrong.

  
  
  

  Please use (excerpt from my answer on Webmasters):

  
  
  

  ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA
  
  

  
  
  

  in order to get 95 or 100 % on SSL Labs - Ciper strength score, more info in my answer on Webmasters.

  
  



• You should enable P-384 + P-256, and optionally P-521 curves, as stated in my answer on Webmasters.

TLS 1.1 is no longer mandatory.

• You have omitted TLS 1.1 protocol. It is still mandatory to HIPAA guidance AFAIK, you should consider enabling it for the time being.

Editor's Note

Beware, using a PPA might ruin your system, at least the future distribution upgrades, from my experience at least.

If you are ready to take the risk...

You may use this PPA, this command adds it to your system without any hassle:

sudo add-apt-repository ppa:ondrej/apache2

At the time of this writing, the current version was:

$ apache2 -v



Server version: Apache/2.4.37 (Ubuntu)

Server built:   2018-10-28T15:27:08

TLSv1.3 is supported in that version.

To enable it globally for all VirtualHosts, locate your ssl.conf and set:

SSLProtocol -all +TLSv1.2 +TLSv1.3

Then restart Apache2 and it should be ready for a test, notably it on these sites:

https://www.ssllabs.com/ssltest/

https://www.htbridge.com/ssl/

My example result = TLSv1.3 enabled