The CRIME attack (CVE-2012-4929) exploits TLS/SSL compression to steal sensitive information like session cookies. While Apache 2.2.22+ includes native SSLCompression off support, older versions like 2.2.15 require alternative approaches.

First confirm your Apache version and SSL module status:

# Check Apache version
httpd -v

# Verify mod_ssl is loaded
apachectl -M | grep ssl

The most reliable fix is upgrading OpenSSL to a version that disables compression by default (1.0.1+):

# For RHEL/CentOS/Scientific Linux 6:
yum update openssl
service httpd restart

If upgrading isn't possible, recompile mod_ssl with compression disabled:

# Download matching Apache source
wget http://archive.apache.org/dist/httpd/httpd-2.2.15.tar.gz

# Configure with no compression support
./configure \
 --enable-ssl \
 --with-ssl=/usr/include/openssl \
 --disable-ssl-compression

make
make install

While not a complete fix, prioritizing non-compression ciphers helps:

# In httpd.conf or ssl.conf
SSLCipherSuite "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"
SSLHonorCipherOrder on

Test your configuration using OpenSSL:

openssl s_client -connect yourdomain:443 -comp
# Should return "Compression: NONE"

If all else fails, place a newer Apache or NGINX instance as a reverse proxy:

# nginx proxy configuration example
server {
    listen 443;
    server_name yourdomain.com;
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
    location / {
        proxy_pass http://backend:80;
    }
}

---

The CRIME attack (CVE-2012-4929) exploits TLS compression vulnerabilities, making it crucial to disable SSL compression in web servers. While Apache HTTPD 2.2.22+ natively supports SSLCompression off, older versions like 2.2.15 require alternative approaches.

Attempting to use SSLCompression off in Apache 2.2.15 generates an error because:

Syntax error on line 147 of /etc/httpd/httpd.conf:
Invalid command 'SSLCompression'

This occurs because the directive wasn't backported in RHEL/CentOS/Scientific Linux 6.x packages.

For environments where upgrading isn't feasible, consider these approaches:

Option 1: Rebuild OpenSSL with No-Compression

# Recompile OpenSSL with no-comp flag
./config no-comp
make && make install

Then restart Apache. Verify with:

openssl s_client -connect localhost:443 | grep "Compression"

Option 2: Use mod_security Rules

Add this to mod_security configuration:

SecRule &TX:CRIME "@eq 1" "phase:1,id:1000,deny,msg:'CRIME attack detected'"
SecRule REQUEST_HEADERS:Accept-Encoding "\bdeflate\b" "phase:1,id:1001,setvar:tx.crime=1"

Option 3: Upgrade via Third-Party Repositories

For RHEL-based systems:

# Install IUS repo (for CentOS/RHEL 6)
rpm -Uvh https://centos6.iuscommunity.org/ius-release.rpm
yum replace httpd --replace-with=httpd22u

After implementing any solution, test with:

openssl s_client -connect yourdomain.com:443 -tls1 -cipher "ALL:COMPLEMENTOFALL" | grep "Compression"

Expected output should show:

Compression: NONE

• Upgrade to Apache 2.2.23+ where possible
• Consider migrating to Apache 2.4.x which includes better TLS handling
• Implement full TLS best practices including disabling weak ciphers