How to create SAN Certificate and its usage

 SAN Stands for Subject alternative name . Where the same certificate with multiple names used for multiple domains . This will save cost .Example we can generate one certificate and add other domain names in the subject Alternative Names can use for multiple sites .

Follow below steps for generation SAN certificate to configure in Apache WebServer .

create san.conf file with the below sample content
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
prompt= no
req_extensions = req_ext
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
stateOrProvinceName = State or Province Name (full name)
localityName = Locality Name (eg, city)
organizationName = Organization Name (eg, company)
commonName = Common Name (e.g. server FQDN or YOUR name)
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 = abc.com
DNS.2 = def.com
DNS.3 = fgh.com

Updated san.conf looks like below for multiple common names

Generate key with csr file using below openssl command
openssl req -out sslcert.csr -newkey rsa:2048 -sha256 -nodes -keyout private.key -config san.conf

once CSR file is generated you can verify the content on the https://www.entrust.net/ssl-technical/csr-viewer.cfm
copy content of sslcert.csr into the above UR or use below
openssl req -noout -text -in sslcert.csr | grep DNS

You can verify CSR with openssl

Once CSR is verified .Get this signed with Third pary vendor line Entrust ,Symatic --etc
Down load the CSR and root , Intermediate certs in PEM format .

for Apache SSL configuration we need 3 files . 
Rename given CER to httpd.cer for SSLCertificateFile . private.key to httpd.key . Create SSLCACertificateFile by appending Intermediate with Root.cer files.

cat intermediate.cer >httpd_ca.crt && cat root.cer >>httpd_ca.crt

SSLCertificateFile /web/apache/WEB1A/ssl/httpd.cer
SSLCertificateKeyFile /web/apache/WEB1A/ssl/httpd.key
SSLCACertificateFile /web/apache/WEB1A/ssl/httpd_ca.crt

JBOSS EAP Patching and Rollback steps

Refer below JBOSS patching and reversion steps 

JBOSS Patching

Download Patch from https://access.redhat.com/downloads/.
Before running any jboss commands please make sure JAVA_HOME is set
export JAVA_HOME=/app/java8_64
Go to JAVA_HOME/bin and run jboss-cli.sh then run below to patch
patch apply /path/to/downloaded-patch.zip

[standalone@localhost:9999/] patch apply /tmp/jboss-eap-6.4.2.zip
"outcome" : "success",
"response-headers" : {
"operation-requires-restart" : true,
"process-state" : "restart-required"
}
}
updated modules available in JBOSS_HOME/modules/system/layer/base/.overlay
Once patch is successfull then restart the services

Patch Rollback

[standalone@localhost:9999/] patch rollback --patch-id=jboss-eap-6.4.2.CP --reset-configuration=true
{
"outcome" : "success",
"response-headers" : {
"operation-requires-restart" : true,
"process-state" : "restart-required"
}
}

Restart the services after successfull rollback

-->During Jboss patching if you get any error says /tmp is full . By default jboss used /tmp as temperary directory .
Can change it by -Djava.io.tmpdir=<new path>
export JAVA_OPTS="-Djava.io.tmpdir=<new path>"
--> To preseve any config file use --preserve=[bin/jboss-cli.xml]

configure Custom Identity and Custom Trust store in Weblogic

 

In this we will see how to generate self-signed certificate and configure to Weblogic Admin server .Before configuration we have demo certificate

Generated Self-Signed certificate with the below command . We can generate CSR from it and get it signed from third party . SSL configuration steps remain same .

/apps/java11_64/bin/keytool -genkey -v -alias weblogic -keyalg RSA -keysize 2048 -sigalg SHA256withRSA \
-dname "CN=www.abc.com, OU=abc, O=ABC Corp, C=IN, ST=Banglore, L=India" \
--keypass password -storepass password -validity 365 -keystore keystore.jks

Configuring Custom Keystore and truststore will see now .

Login to WLS Admin console
--> Go to Enviroment /Servers and click on the server for which ssl need to enable
--> Go Keystores tab change keystore to Custom Identity and Custom Trust
--> Enter keystore and truststore details then save
--> GO to SSL Tab then enter the certificate to use and keypassword and save

Restart the Admin sever since we did the SSL configuration to Admin server . We need to follow same for each Managed instance on Weblogic for SSL

Now admin logs are loding cert and trust certs from /apps/ssl/keystore.jks 
Here we used same keystore for both key and trust certs . We can configure seperate trust store if need.

<Dec 25, 2020, 12:24:07,261 PM Singapore Standard Time> <Notice> <Security> <BEA-090171> <Loading the identity certificate and private key stored under the alias weblogic from the jks keystore file /apps/ssl/keystore.jks.> 
<Dec 25, 2020, 12:24:07,565 PM Singapore Standard Time> <Notice> <Security> <BEA-090169> <Loading trusted certificates from the jks keystore file /apps/ssl/keystore.jks.> 
<Dec 25, 2020, 12:24:07,929 PM Singapore Standard Time> <Warning> <Security> <BEA-090172> <No trusted certificates have been loaded. Server will not trust to any certificate it receives.> 

Expot same cert and import back to same keystore as trust cert. because self signed is signed by it self so same cert is need in trust as well.
Export certificate
keytool -exportcert -alias weblogic -file wls.cer -keystore keystore.jks

Add as trust 
[wlsuser@localhost ssl]$ /apps/java11_64/bin/keytool -import -alias root -file wls.cer -keystore keystore.jks 

Enter keystore password:  
Certificate already exists in keystore under alias <weblogic>
Do you still want to add it? [no]:  yes
Certificate was added to keystore
[wlsuser@localhost ssl]$ /apps/java11_64/bin/keytool -list -keystore keystore.jks 
Enter keystore password:  
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 2 entries

root, Dec 25, 2020, trustedCertEntry, 
Certificate fingerprint (SHA-256): B9:CE:10:5C:7C:9D:D9:6B:DF:DC:62:25:DF:FE:86:E2:EF:A0:58:A0:C3:EC:7A:51:93:8E:CC:4D:5E:09:AE:E2
weblogic, Dec 25, 2020, PrivateKeyEntry, 
Certificate fingerprint (SHA-256): B9:CE:10:5C:7C:9D:D9:6B:DF:DC:62:25:DF:FE:86:E2:EF:A0:58:A0:C3:EC:7A:51:93:8E:CC:4D:5E:09:AE:E2
[wlsuser@localhost ssl]$

If we dont import same cert as trust certificate then the server will start but cannot able to load the page .

After successful SSL configuration we can see new certificate in Weblogic console .

How to know the validity of a certificate installed on the server

 

There are multiple ways to get the validity of the certificate installed on the server .

1.If we have access to server login and open the keystore and verify using keytool

keytool -details -alias mycert -keystore abc.jks -password **** -v

2.use one of the client to browse the URL using https://ip:port:/ that will present the certificate in the browser after successful connection .

3.Use openssl to get the certificate and verify the validity .

openssl s_client -connect ip:port 2>/dev/null |openssl x509 -noout -dates

How to fix Weblogic startup slowness issues

 There might be multiple reasons for the startup slowness . To troubleshoot the issue fist remove the application targeted from the application server for this JVM and then try to start the server alone . If we still get the issue then it is something not relevant to Application .Refer the below in some cases this solve the issue where the application is not using random number generator . before implementing the change get the confirmation once with App team and finalise the change .

The library used for random number generation in Oracle’s JVM relies on /dev/random by default for UNIX platforms. This can potentially block the WebLogic Server process because on some operating systems /dev/random waits for a certain amount of “noise” to be generated on the host machine before returning a result.

Although /dev/random is more secure, it’s recommended to use /dev/urandom if the default JVM configuration delays WebLogic Server startup. To determine if your operating system exhibits this behavior, try displaying a portion of the file from a shell prompt: head -n 1 /dev/random

If the command returns immediately, you can use /dev/random as the default generator for JVM. If the command does not return immediately, use these steps to configure the JVM to use /dev/urandom:

Open the $JAVA_HOME/jre/lib/security/java.security file in a text editor.
Change the line “securerandom.source=file:/dev/random” to read: securerandom.source=file:/dev/./urandom
Save your change and exit the text editor.
And because there’s a bug in JDK when you use /dev/urandom you have to set it up as /dev/./urandom

You can also set up system property “java.security.egd” which will override the securerandom.source setting.
-Djava.security.egd=file:/dev/./urandom

Take backup of java.security and update the value of securerandom.source=file:/dev/./urandom and restart the server . 

Shell Scripting for Beginners

 A shell script is a file containing series of commands .The shell reads this file and run each command as if like it entered on the command line.On a Linux Operating System there are multiple Interpreters which will execute the commands that we pass to them . Default is Bash and this is widely available on various operating systems . Other 's are KSH,SH . Some commands may different on there interpreters but majority will support by all.

1.What is shell Scripting
2.Variables
3.File Manipulations
4.Common Iterations/Loops
5.Useful System Variables
6.Test Operators
7.Numeric Tests
8.String tests
9.Logical Tests
10.Argument Variables
11.Some Advance commands ,utilities ,network and file handling commands

1.What is shell Scripting

  In short and simple a shell script is a file containing series of commands .The shell reads this file and run each command as if like it entered on the command line.
  The benefit of this is to simplify the day to day mundane activities . Shell is a scripting language interpreter.
  Scripts unlock the power of our Linux machine. imagine you have 2 files on with 100 words and another with 100000 words and you need to check first file words on second file and print the word existence and no of times present .
  This is where the power of scripting comes .Once you write a simple script then start using it and enhance further to fit into day to day activities .
#!/bin/bash
echo "Hello World"

First line #!/bin/bash is the interpreter which will execute the commands . Next to that are the commands . echo will print the values in the screen .

2.Variables

 Variable is a keyword to store some values . We have some System predefined variable and user can also define variables in the scripts to store the results of commands .
 Example :
 PATH is the OS define variable .run echo $PATH to print the values 
 VALUE=`date` && echo $VALUE --> here VALUE is user defined variable and it exists till the script finishes .Once finished VALUE variable no more exist.

3.File Manipulations

Below table gives the basic file manipulation operation help full while handling the files.

File Commands	Explaination
> file	Create/Overwrite file
>> file	Append to file
>file 2>&1	redirect both output and error to file
< file	read from file
file1 | file1	pipe output of file1 as input to file2

4.Common Iterations/Loops

Below given blocks are very important because in the scrips for each command that we use we need to check something before executing and store the results some where and iterate through some repetitive steps .

read text file line by line . in many scenarios we need to read file line by line and apply the logic .In the below we are reading and printing with echo.

while read line 
do 
  echo "Line is $line
done < file 

Find matching lines

grep foo file --> print the lines that has foo matching word
egrep 'foo|bar' file -->find multiple word and print the matching lines
grep -i FOO file --> same as above but i for ignore case
grep -v foo file --> -v used to print not matching lines 

Get the output of command to a variable

FILELIST=`ls`
COUNTOFFILES=`ls -lrt |wc -l`

Case is a good way to Iterate avoiding multiple if/elif blocks

case.sh
#!/bin/bash
# case example
 $1 means first argument in the script
# Usage ./case.sh argument
case $1 in
	start)
		echo starting
	;;
	stop)
		echo stoping
	;;
	restart)
		echo restarting
	;;
	*)
		echo don\'t know
	;;
esac

Function declaration and calling ...

multiply() {
	expr $1 \*2
	}
multiply 3 

For loop iterates the in the list of give values and run the logic

for i in 1 2 3 4 5 
do
	echo "In $i loop"
	echo "Do some logic here "
done	

5.Useful System Variables

$? --> what the shell returned or previous command return status
0 means success
other value means failure
This $? verification is very useful to check the status of previous command to take next decession
$* --> all arguements
./abc.sh 1 2 --> in this $* is 3
$# --> No of the variable values . where $0 is name of script , $1 is 1st arguement ,$2 is 2nd arguement

6.Test Operators

# Compare 2 variable and do something 
if [ "$x" -lt "$y" ] ; then
 # Do something
 fi

7.Numeric Tests

Numeric Test operations	Explaination
lt	less than
gt	greate than
eq	equal
ne	not equal
ge	greate or equal
le	less than or equal

8.String tests

File Test operations	Explaination
nt	newer than
d	is a directory
f	is a file
r	readable
w	writable
x	executable

9.Logical & String Tests

Logical & String Tests	Explaination
=	equal to
z	zero lenth
n	not zero length
&&	Logical AND
||	logical OR
!	logical Not

10.Argument Variables

Argument Variables	Explaination
$0	Program name or script name
$1	1st argument
$2	2nd arguments
…	…
$9	9th argument
$*	all aguements
$#	No of Arguments

11.Some Advance commands ,utilities ,network and file handling commands

below are some of the commands that we daily use for the day-to-day activities.

Linux Commands	Usage
command1 ||Command2	run command1; if it fails, run Command2
command1 && Command2	run command1; if it works, run Command2
command1 ; Command2	keeping 2 commands on the same line
ls -lSt	list files biggest last
ls -lrt	list files newest last
ls -al	show all fils including hidden
sort -n	sort numarically
wget URL	download url
read x	read some value from user /keyboard
touch file	create empty file
cmd |tee file.txt	command output to stdout also to file.txt
ifconfig -a	list all network interfaces .can see ip here
netstat -r	show routers
netstat -tnpl |grep -I listen	shows all listening ports on the server
ssh u@host	login to host as user u
scp file.txt u@host:\tmp	copy file.txt to host /tmp/ wit u user
alias l='ls -lrt'	creating alias to a command
df -h	show dis mount points
find . -type f -name a.txt	find a.txt in current directory
find . -type f -name *.txt -print	find all the txt files
find /foo -type d -ls	list all directories under foo
awk -F":" '{ print $1 " " $NF}'	print file value in each line of the file delimted with : and NF for last value
tar -cvf abc.tar a.txt b.txt	create acrchive file
tar -tvf abc.tar	check the list of file in abc.tar
tar -rvf abc.tar c.txt	add c.txt to existing abc.tar
tar -xvf abc.tar	extract abc.tar file
tar -zcvf my_archive.tar.gz *	create zip and then tar
tar -zxvf my_archive.tar.gz *	extract zip tar
zcat	view the file without decompressing it like cat
ps -ef |grep keyword	grep some process running
kill -9 pid	kill process with pid
pwd	present working dir
cd	Go to user home
cd ..	Go to previous directory
hosname	hostname of the server

Hope the blog gives some useful information for starting writing scripts ...

Linux find and replace

 

There is a requirement to find and replace a string from file's in the in the directory name across all the files and directories in the given directory.

We already know some basic commands like mv,sed/perl & find commands . We will use these basic commands to write a script and get the expected result .

basic commands 

mv
mv ABC DEF  -> to rename a directory
find
find /dir -type f -exec grep -l "ABC" {} \; | xargs perl -pi -e 's/ABC/DEF/g' 
Above command is used find and replace ABC in all the files with DEF on /dir 
sed
sed 's/ABC/DEF/g' -->To replace a string in a word 
perl
perl -pi -e 's#ABC#DEF#g' file --> this searches and replaces ABC to DEF .

We combine this in to 2 scenarison .

1. To find and replace the string in given file .
2. To find and replace the string in the directy recursivley along with matched sub directory string .

On the below we have ABC directory with abc.txt and ACBC directory . Test results for both scenarios 1 and 2 given below .

Scenario 1 :

Scenario2 :

1.sh

#!/bin/bash
echo "Enter file Name"
read fileName
echo "Enter findstring "
read findstring
echo "Enter replacestring "
read replacestring
if [ -f $fileName ] ; then
 perl -pi -e 's#'$findstring'#'$replacestring'#g' $fileName
 echo "$findstring replace with $replacestring "
 else
 echo "Given file is not available "
fi

2.sh

#!/bin/bash
echo "Enter Dir Name"
read dir 
echo "Enter findstring "
read findstring
echo "Enter replacestring "
read replacestring
if [ -d $dir ] ; then
 find $dir -type f -exec grep -l "$findstring" {} \; | xargs perl -pi -e 's/'$findstring'/'$replacestring'/g' 
 echo " Word $findstring replaced with $replacestring successfully ..."
 for directory in `find $dir -type d -name "$findstring"` 
  do
    newDirName=`echo $directory |sed 's/'$findstring'/'$replacestring'/g'`
	mv $directory $newDirName
	echo " $directory name changed to $newDirName "
  done
 else
  echo "Directory not found : $dir "
fi

set -x and set +x are for debugging . Hope this article helps in detail for find and replace . ..

SSL Setup in JBOSS Using Elythron

Follow below steps to setup SSL using Elythron on JBOSS EAP 7.X 

1.Create JKS file and generate self signed certificate

keytool -genkey -alias jboss -keysize 2048 -validity 365 -keyalg RSA -sigalg SHA256withRSA -keystore jboss.jks -storepass jboss@123 -keypass jboss@123 -dname "CN=example.com, OU=blog, O=AskMiddlewareExpert.com, C=IN"

Configure a keystore

/host=master/subsystem=elytron/key-store=httpsKS:add(path="${jboss.home.dir}/ssl/jboss.jks", credential-reference={clear-text=jboss@123}, type=JKS)
2.Connect JBOSS Cli mode to configure keystore, key-manager and ssl-context in Elytron

Create a new key-manager

/host=master/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm="SunX509",credential-reference={clear-text=jboss@123})

Configure new server-ssl-context reference with protocol and ciphers

/host=master/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=["TLSv1.2"], cipher-suite-filter="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA")

Run the above 3 CLI commands to make changes within profile eg. full-ha in domain.xml as below:

/profile=full-ha/subsystem=elytron/key-store=httpsKS:add(path="/home/sshriram/EAP7.1/7.1/LDAP/jboss-eap-7.1/domain/configuration/jboss.jks", credential-reference={clear-text=jboss@123}, type=JKS)

/profile=full-ha/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm="SunX509",credential-reference={clear-text=jboss@123})

/profile=full-ha/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=["TLSv1.2"], cipher-suite-filter="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA")

3.Configure undertow to map ssl-context of Elytron

[domain@localhost:9990 /] batch
[domain@localhost:9990 / #] /profile=full-ha/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
[domain@localhost:9990 / #] /profile=full-ha/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=httpsSSC)
[domain@localhost:9990 / #] run-batch

4) If you want management-interface to use the same ssl-context, execute the following command which will enable SSL in management-interface

[domain@localhost:9990 /] /host=master/core-service=management/management-interface=http-interface:write-attribute(name=ssl-context, value=httpsSSC)
[domain@localhost:9990 /] /host=master/core-service=management/management-interface=http-interface:write-attribute(name=secure-port,value=8443)

Reload the servers to make the change effective.

reload --host=master

5.Restart Jboss and verify https url's reflected with the self-signed certificate that we generated .

We can also enable SSL in the traditional way . And the content of xml file loos like below .standalone.xml (or host.xml for domain) 

<security-realms>
    <security-realm name="CertificateRealm">
        <server-identities>
            <ssl>
                <keystore path="/path/to/keystore.jks" keystore-password="secret" alias="servercert"/>
            </ssl>
        </server-identities>
        <authentication>
            <truststore path="/path/to/truststore.jks" keystore-password="secret"/>
        </authentication>
    </security-realm>
</security-realms>

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
    <buffer-cache name="default"/>
    <server name="default-server">
        <http-listener name="default" socket-binding="http" redirect-socket="https"/>
        <https-listener name="https" secure="true" enabled-protocols="TLSv1.1,TLSv1.2" security-realm="CertificateRealm" socket-binding="https"/>
...

Under profile undertow CertificateRealm will be mappted to https https-listener.

https name is refered in the port interface .

How to clear WebSphere tmp files

 It is better to always remove temp and wstemp when there is any update with application or re-deploy the application . But safer to take backup of the complete profile before making any deletion .

profile_root//temp and profile_root//wstemp these are the location of the temporary files in Websphere Application server .

WebSphere Application Server uses multiple temporary locations for many reasons. This post explains the most commonly used temporary files, why they are used and when they can be removed. This blog will also explain the files and directories that can be removed under the profile direction with caution.

Important:

• Be careful in deleting any temporary, cache and log files in WebSphere Application Server!
   
• Before making any changes to the environment , take a backup of the profile. It can be a tape backup, using the backupconfig tool, or using the manageprofile -backupProfile option.
  
  profile_root example: C:/WebSphere/AppServer/profiles/profile_name
  install_root example: C:/WebSphere/Appserver

Let's describe the different files and their locations:

• profile_root/wstemp
  Usage: wstemp is a workspace temporary directory. Any changes that you make to the configuration are stored in the wstemp directory temporarily. For example, if you are changing the heap size for an application server, the change is stored in the wstemp location until you save the changes. The concept is same for any administrative client, such as the Integrated solution console, wsadmin or JMX, that you use to make the changes.
  
  Caution: The WebSphere Application Server administrative console stores a preferences.xml file in install_root/wstemp/<workspace_id>. This file contains user preferences on administrative console layout and actions. It is created when you log onto the administrative console. If you remove this file, you lose the user preferences; however,  the preferences can be created again the next time you log onto the administrative console.
  
  Do not delete the wstemp files when the server is running (especially deployment manager or node agent servers). This approach can cause unexpected results. Also, do not delete the files when you are unsure about the changes that you made to the configuration. Save any pending changes, stop the deployment manager or node agent, which depends on whether you are removing the dmgr wstemp or node wstemp, and then delete the wstemp files.
  
  Why remove these files?: Files in the profile_root/wstemp directory can be removed. Restart the server process after removal. Because the directory is  used by multiple clients, some times you might see multiple files and subdirectories left behind in this directory. For example, when you use the ConfigService MBean to make changes to configuration and you do not discard the session in the code, this directory will never get deleted. Another reason is corruption in the workspace. Corruption can happen when multiple users make changes to the same configuration at the same time.
   
• profile_root/temp
  Usage: The temp directory is used by multiple WebSphere components. Two good examples are compiled Java ServerPages (JSP) files and web service cache files. Compiled JSP class files (servlets) are stored in this location. The directory might get regenerated when you invoke the JSP again. However, you might experience a performance issue when you invoke the JSP for the very first time after the JSP compiled files have been removed.
  
  Caution:  Be cautious if you have a web services application deployed on the node. The wscache.xml is generated during the deployment process and stored under the temp directory. You have to redeploy the web service application to generate the wscache.xml again. You may experience some performance issue with large and complicate webservices application
  
  Why remove these files?: Corrupted JSP files or any non-root permission issues might cause the server start up issue.

Never delete any other files or directories for WebSphere Application Server unless otherwise directed by the IBM Support team.

Clear Weblogic temp/cache files

It is better to always remove tmp and cache when there is any update with application or re-deploy the application . But safer to take backup of the complete directory before making any deletion .

Recently when working with new application update I found that just bouncing/ restarting server is not enough, we will also need to clean up the cache so that new changes take effect. We will see how to clean temporary directories in Weblogic .

Find out the Domain directory under which our Managed instance folder's exist . Some customised Weblogic domain existing on a different location .If you dont know the location then on the Weblogic installation location find domain_registry.xml file . In this file you can see the list of Domain's created and it's paths .

Each managed server have its own tmp and cache directory .

--> Shut down Server.

--> Delete the contents of the folder ORACLE_HOME/user_projects/domains/your_domain/servers/your_server/tmp…

You can also delete ORACLE_HOME/user_projects/domains/your_domain/servers/your_server/cache

-->Restart Server.

You can also do something like this . In your startup script you can add delete statements so that every time the server restarted new tmp and cache will be re-created .

Note: Do not delete any other directories under the server . If you deleted then restoration is difficult and lead to startup issues .

Add Ciphers and Protocols in Apache httpd server

 

Add listed Ciphers using SSLCipherSuite directive in Apache HTTPD inside SSL virtual host as below :

~~~~~~~

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1<br>

SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

~~~~~~~

- SSL 3.0 and TLS 1.0 are susceptible to known attacks on the protocol; they are disabled entirely.

- Disabling TLS 1.1 is (as of August 2016) mostly optional; TLS 1.2 provides stronger encryption options, but 1.1 is not yet known to be broken. Disabling 1.1 may mitigate attacks against some broken TLS implementations.

In addition, you can use SSL server which accepts strong encryption only by adding following directives too 

~~~~~~~

SSLHonorCipherOrder on

SSLCompression      off

SSLSessionTickets   off

~~~~~~~

- Enabling SSLHonorCipherOrder ensures that the server's cipher preferences are followed instead of the client's.

- Disabling SSLCompression prevents TLS compression oracle attacks (e.g. CRIME).

- Disabling SSLSessionTickets ensures Perfect Forward Secrecy is not compromised if the server is not restarted regularly.

More details about the SSL directives can be found in <a href="https://httpd.apache.org/docs/2.4/mod/mod_ssl.html">ApacheModSSL</a>