Skip to main content

Why isn't forward secrecy working when the Strict-Transport-Security header is added to an Apache include.

Eric Delorme
  • Updated

Symptoms

The Strict-Transport-Security header was added to an Apache include and Apache restarted but the SSL grade is still not an A using something like SSLLABS to test.

 

Description 

SSLHonorCipherOrder needs to be turned on in order for the server side settings to be used instead of the client side.

Apache documentation for reference can be found at SSLHonorCipherOrder Directive

 

Workaround

Modify the include file that likely had the header added at

 /etc/apache2/conf.d/includes/pre_main_global.conf

and add the following

SSLHonorCipherOrder on

Then restart Apache with

/scripts/restartsrv_httpd --hard

Related articles