How to disable SSL v2 for PCI Compliance

Many people need to disable SSLv2 for PCI compliance, but are not sure how to do so.

Difficulty:

Moderately Easy

Instructions

1. First thing, test it out to make sure its enabled.
   You can use the following openSSL command:
   openssl s_client -host YOUR_IP -port 443 -verify -debug -ssl2

2. You should see an output similar to this if its disabled:
   verify depth is 0
   CONNECTED(00000003)
   4738:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:429:
   or
   verify depth is 0
   CONNECTED(00000003)
   write:errno=104

3. If you get back a full response that includes a parsed version of your certificate, then its enabled. Dont fret, its pretty easy to disable, by just putting in a few lines into one (possibly two) files.

4. Add these lines to /etc/httpd/conf.d/ssl.conf file
   SSLProtocol all -SSLv2
   SSLCipherSuite ALL:!ADH:!NULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:+SSLv3:+TLSv1:-SSLv2:+EXP:+eNULL

5. Restart Apache
   service httpd restart

6. If you are running Plesk and want to disable SSLv2.0 for your Plesk HTTPS on port 8443, you can do the same thing by inserting the lines into /usr/local/psa/admin/conf/httpsd.custom.include and then restarting Plesk service
   service psa stop
   service psa start all