The bigger problem with CentOS (Red Hat) is that they do not support Elliptic Curves, which are necessary for Forward Secrecy. If you're using Apache, you can

The bigger problem with CentOS (Red Hat) is that they do not support Elliptic Curves, which are necessary for Forward Secrecy. If you're using Apache, you can compile your own from source, using static linking against OpenSSL. That way, you can have the latest versions of both. I have a blog post that describes the process: http://blog.ivanristic.com/2013/08/compiling-apache-with-static-openssl.html http://blog.ivanristic.com/2013/08/compiling-apache-with-sta... While you're there, you might also want to patch Apache to support configurable DH parameters: http://blog.ivanristic.com/2013/08/increasing-dhe-strength-on-apache.html http://blog.ivanristic.com/2013/08/increasing-dhe-strength-o...