mjhjmtu

I am running Apache2 version:

Server version: Apache/2.4.29 (Ubuntu)
Server built: 2018-04-25T11:38:24

I would like to enable TLSv1.3 but I get an error below in Apache2 if I put SSLProtocol TLSv1.2 TLSv1.3 in the ssl.conf file:

# apachectl configtest

AH00526: Syntax error on line 79 of /etc/apache2/mods-enabled/ssl.conf:
SSLProtocol: Illegal protocol 'TLSv1.3'
Action 'configtest' failed.
The Apache error log may have more information.

Is it not possible to enable TLSv1.3 in Apache2 (yet)?

I know Nginx can do it, but this question aims at Apache2.

TLSv1.3 is not yet supported by Apache 2.4.

When it is supported by OpenSSL (see info here), Apache 2.4 should have it too.

TLSv1.3 is now supported in Apache2 version 2.4.36 with OpenSSL 1.1.1 Source.

Editor's Note

Beware, using a PPA might ruin your system, at least the future distribution upgrades, from my experience at least.

If you are ready to take the risk...

You may use this PPA, this command adds it to your system without any hassle:

sudo add-apt-repository ppa:ondrej/apache2

At the time of this writing, the current version was:

$ apache2 -v

Server version: Apache/2.4.37 (Ubuntu)
Server built: 2018-10-28T15:27:08

TLSv1.3 is supported in that version.

To enable it globally for all VirtualHosts, locate your ssl.conf and set:

SSLProtocol -all +TLSv1.2 +TLSv1.3

Then restart Apache2 and it should be ready for a test, notably it on these sites:

https://www.ssllabs.com/ssltest/

https://www.htbridge.com/ssl/

My example result = TLSv1.3 enabled

Debian Buster = TLSv1.3 supported

In Debian Buster (currently in testing), the TLSv1.3 is supported already.

The following information is dated to:

# date -I

2019-02-24

Apache2 version:

# apache2 -v

Server version: Apache/2.4.38 (Debian)

Server built: 2019-01-31T20:54:05

Where to enable

Globally in:

/etc/apache2/mods-enabled/ssl.conf

Locally in:

Your VirtualHost(s) located in:

/etc/apache2/sites-enabled/

How to enable

To this date, the TLSv1.1 has been deprecated finally. So, you want only TLSv1.2 and TLSv1.3.

To do that, put this line in the above-mentioned file:

SSLProtocol -all +TLSv1.3 +TLSv1.2

Cipher suites

The cipher suites are now divided into 2 categories, that being SSL (below TLSv1.3) and TLSv1.3, you may want to use your own set of ciphers, take this only as an example:

SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
SSLCipherSuite SSL ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256

Curves

One important note to the end:

There is one new curve you could / should enable: X25519.

You can do this for instance like this, again only example:

SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1

Example domain test on SSLLabs

Experimental: This server supports TLS 1.3 (RFC 8446).