--- title: SSL v3 Vulnerability - Remedies and What You Can Do description: Poodle Open SSL v3 Vulnerability remedies and recommendations, what to do to protect against it. image: http://businessinsights.bitdefender.com/hs-fs/hub/341979/file-1873780650-jpg/Blog_pics/poodle.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) By [**Shaun Donaldson**](https://businessinsights.bitdefender.com/author/shaun-donaldson) / Oct 15, 2014 # SSL v3 Vulnerability - Remedies and What You Can Do Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies&utm_medium=social&utm_source=facebook)   If you are running systems that maintain SSL 3.0 compatibility, you are advised to **define a Signaling Cipher Suite Value (SCSV)** to **prevent unintended protocol downgrades** between clients and servers when both parties support a higher version of the protocol. Disabling fallback to lower protocols is different from operating system to operating system. Here are some guidelines for the most frequently used webservers: **Internet Information Services (IIS)** Microsoft Windows NT Server stores protocol information in the HKey\_Local\_Machine\\System\\CurrentControlSet\\Control\\SecurityProviders \\SCHANNEL\\Protocols registry key. This key contains subkeys for PCT 1.0, SSL 2.0, SSL 3.0 and TLS 1.0. You can disable any of these protocols by creating a new DWORD value with the “00 00 00 00” value in the server subkey corresponding to the protocol to be disabled. More information about configuring crypto on IIS [is available here](http://support2.microsoft.com/kb/187498). **Apache HTTPD Server** Include the following line in the server configuration file: *SSLProtocol All -SSLv2 -SSLv3*. Restart the service with *sudo service apache2 restart* (If running Linux). **Nginx server** Include the following line in the Nginx configuration file: *ssl\_protocols TLSv1 TLSv1.1 TLSv1.2;* Restart the service with sudo service nginx restart (if running Linux).![poodle](http://businessinsights.bitdefender.com/hs-fs/hub/341979/file-1873780650-jpg/Blog_pics/poodle.jpg?width=675&name=poodle.jpg) **Postfix SMTP** Add or change the smtpd\_tls\_mandatory\_protocols directive like this: *smtpd\_tls\_mandatory\_protocols=!SSLv2,!SSLv3* Restart Postfix with *sudo postfix restart* for the changes to take effect. **HAProxy Server** Edit the /etc/haproxy.cfg file and find your bind line. Append no-sslv3 directive like in the example below: *bind :443 ssl crt ciphers no-sslv3* More info on configuring webservers under Linux is available [here](http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566). **JBoss Web** Configure the https connectors to have the sslProtocol attribute set to "TLS" in the configuration file:       **Tomcat** The SSL protocol to be used can be configured via $TOMCAT\_HOME/conf/server.xml: **Tomcat APR** Similar to Tomcat, the protocol to be used is defined in the $TOMCAT\_HOME/conf/server.xml file:   For more information on mitigating unwanted protocol downgrades, please refer to the [TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks](https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-01) draft. **[Read More](https://bettercrypto.org/static/applied-crypto-hardening.pdf) on Applied Crypto Hardening!**   ### Explore More Topics - [Enterprise Security (743)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (201)](https://businessinsights.bitdefender.com/topic/threat-research) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [SMB Security (170)](https://businessinsights.bitdefender.com/topic/smb-security) - [Ransomware (166)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (137)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (134)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (126)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (124)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (119)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [Threat Intelligence (76)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [IT Compliance & Regulations (71)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (55)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (53)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (46)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (38)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (18)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (9)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (3)](https://businessinsights.bitdefender.com/topic/podcast) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [What’s New in GravityZone Platform September 2024 (v 6.55)](https://businessinsights.bitdefender.com/whats-new-in-gravityzone-platform-september-2024-v-655?hsLang=en-us) ### [What’s New in GravityZone February 2026 (v 6.70)](https://businessinsights.bitdefender.com/whats-new-gravityzone-february-2026?hsLang=en-us) ### [Technical Advisory: CVE-2022-30190 Zero-day Vulnerability “Follina” in Microsoft Support Diagnostic Tool](https://businessinsights.bitdefender.com/technical-advisory-cve-2022-30190-zero-day-vulnerability-follina-in-microsoft-support-diagnostic-tool?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ![](https://px.spiceworks.com/px/5rec) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Shaun Donaldson", "url" : "https://businessinsights.bitdefender.com/author/shaun-donaldson" }, "datePublished" : "2014-10-15T20:09:00.000Z", "headline" : " SSL v3 Vulnerability - Remedies and What You Can Do", "image" : [ "//businessinsights.bitdefender.com/hs-fs/hub/341979/file-1873780650-jpg/Blog_pics/poodle.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/ssl-v3-vulnerability-remedies", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```