Disable SSL / TLS compression in Apache 2.2.x

Question

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl?

If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers?

Related Links:

1. https://issues.apache.org/bugzilla/show_bug.cgi?id=53219
2. https://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512
3. https://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor

Solution

You can use SSLCompression off if you're on 2.2.24 or later.

If not, you can set the OPENSSL_NO_DEFAULT_ZLIB environment variable to force compression off in OpenSSL - see this question.

Comments

[Stefan Lasiewski]

Also see serverfault.com/questions/455450/…