STIGQter STIGQter: STIG Summary: Apache Server 2.4 UNIX Server Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The Apache web server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.

DISA Rule

SV-214269r961632_rule

Vulnerability Number

V-214269

Group Title

SRG-APP-000439-WSR-000188

Rule Version

AS24-U1-000900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Update the cipher specification string for all enabled SSLCipherSuite directives to include !EXPORT.

Check Contents

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" and "ssl.conf" files:

Search the httpd.conf and ssl.conf file for the following uncommented directive: SSLCipherSuite

# cat httpd.conf | grep -i SSLCipherSuite
Output: None

# cat /etc/httpd/conf.d/ssl.conf | grep -i SSLCipherSuite
Output: SSLCipherSuite HIGH:3DES:!NULL:!MD5:!SEED:!IDEA:!EXPORT

For all enabled SSLCipherSuite directives, ensure the cipher specification string contains the kill cipher from list option for all export cipher suites, i.e., !EXPORT, which may be abbreviated !EXP as in the following example:

Example: SSLCipherSuite="HIGH:MEDIUM:!MD5!EXP:!NULL:!LOW:!ADH

If the SSLCipherSuite directive does not contain !EXPORT or !EXP or there are no enabled SSLCipherSuite directives, this is a finding.

Vulnerability Number

V-214269

Documentable

False

Rule Version

AS24-U1-000900

Severity Override Guidance

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" and "ssl.conf" files:

Search the httpd.conf and ssl.conf file for the following uncommented directive: SSLCipherSuite

# cat httpd.conf | grep -i SSLCipherSuite
Output: None

# cat /etc/httpd/conf.d/ssl.conf | grep -i SSLCipherSuite
Output: SSLCipherSuite HIGH:3DES:!NULL:!MD5:!SEED:!IDEA:!EXPORT

For all enabled SSLCipherSuite directives, ensure the cipher specification string contains the kill cipher from list option for all export cipher suites, i.e., !EXPORT, which may be abbreviated !EXP as in the following example:

Example: SSLCipherSuite="HIGH:MEDIUM:!MD5!EXP:!NULL:!LOW:!ADH

If the SSLCipherSuite directive does not contain !EXPORT or !EXP or there are no enabled SSLCipherSuite directives, this is a finding.

Check Content Reference

M

Target Key

3996