How to get an "A" on Qualys SSL Labs with Apache 2.2?

Apache 2.2.26 added support for ephemeral Elliptic curve Diffie–Hellman (ECDHE). This is likely what is preventing your ability to get an A on on the test. Some Internet Explorer browsers will prefer non-forward secrecy cipher suites when ECDHE is not available. This can also depends on if you prefer the server cipher order and other factors.


The site at http://cipherli.st has config snippets for setting up Qualys-rated A-Grade TLS for Apache, nginx and lighttpd. It also includes statements for HSTS, OCSP-Stapling and X-Frame-Options.

Tags:

Apache

Tls