# Let's Encrypt over-rides Apache's SSLCipherSuite

**URL:** <https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817>\
**Category:** Help\
**Created:** [October 10, 2019, 5:57pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817 "2019-10-10T17:57:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dstiles](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dstiles](https://community.letsencrypt.org/u/dstiles)\
**Post date:** [October 10, 2019, 5:57pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/1 "2019-10-10T17:57:08Z")

</div>

This has been mentioned in an earlier posting [Let’s Encrypt and SSL Labs weak Cipher Suites](https://community.letsencrypt.org/t/lets-encrypt-and-ssl-labs-weak-cipher-suites/52045) but to me was inconclusive.

I have spent some time trying to change Apache’s SSLCipherSuite to exclude some of the weaker ciphers, in part to remove “weak” ciphers from SSLLabs reports. It took me a while to discover that /etc/letsencrypt/options-ssl-apache.conf over-rides Apache’s SSLCipherSuite, since it’s installed in each web site’s VirtualHost, well after SSLCipherSuite has been defined in the Apache “enabled” configs (Apache 2.4.18).

The obvious and immediate solution would be to remove SSLCipherSuite from the letsencrypt config, but a caveat at the top of that file states, “If you modify this file manually, Certbot will be unable to automatically provide future security updates”.

This implies certbot gets its certification from that file. Fair enough. Still a problem for Apache config, though.

Are these inclusions necessary at all, given that the few Apache commands they specify are already defined in either Apache’s ssl.conf and/or security.conf?

Example VirtualHost…

```
<VirtualHost nnn.nnn.nnn:443>
  (various site setup commands)
  Include	/etc/letsencrypt/options-ssl-apache.conf
  SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>
```

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [October 10, 2019, 9:05pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/2 "2019-10-10T21:05:58Z")

</div>

> [@dstiles](#):
>
> This implies certbot gets its certification from that file.

Certbot doesn't rely on _anything_ in that file. It's there purely as a security enhancement to your server.

If you want to modify it to change or remove the ciphersuites, you can. it won't break anything and Certbot will avoid undoing your changes in future - it is intentionally designed in that way.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [October 10, 2019, 9:57pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/3 "2019-10-10T21:57:12Z")

</div>

Maybe we should rephrase “future security updates”; as @_az says, it doesn’t refer to certificates, but rather to server configuration changes.

---

<div class="post-metadata">

**Author:** ![dstiles](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dstiles](https://community.letsencrypt.org/u/dstiles)\
**Post date:** [October 10, 2019, 10:09pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/4 "2019-10-10T22:09:52Z")

</div>

> [@dstiles](#):
>
> “If you modify this file manually, Certbot will be unable to automatically provide future security updates"

> [@](#):
>
> Certbot doesn’t rely on _anything_ in that file.

So if I comment-out SSLCipherSuite, letsencrypt will renew with no problem?

It seems like the warning should certainly be reworded. It's very misleading.

Thanks for the responses, anyway, guys.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [October 10, 2019, 10:14pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/5 "2019-10-10T22:14:51Z")

</div>

I created an issue about this at

> <https://github.com/certbot/certbot/issues/7444>

---

<div class="post-metadata">

**Author:** ![dstiles](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dstiles](https://community.letsencrypt.org/u/dstiles)\
**Post date:** [October 10, 2019, 10:18pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/6 "2019-10-10T22:18:26Z")

</div>

> [@schoen](#):
>
> I created an issue about this at

Thanks! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [November 9, 2019, 10:18pm UTC](https://community.letsencrypt.org/t/lets-encrypt-over-rides-apaches-sslciphersuite/103817/7 "2019-11-09T22:18:26Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.