## 5 Evaluation Approach
### Context Description and Feature Models
In order to configure SSL connections in Apache, SSL/TLS capabilities and restrictions must be considered since those restrictions can determine the implementation of secure connections to the server. For instance, the use of an specific version of the _Procotol_ and _Algorithm_ restricts the number of _Ciphers_ to be used for the compatibility. From the perspective of security the selection of certain protocols can determine the weakness of the connections, for instance, in the use of old version of TLS. For a better understanding of the ciphers' restriction, SSL/TLS protocol is carried out. As aforementioned, there are certain parameters, such as the versions of the protocol, that can be configured in the model. For instance, SSLv3 is discouraged due to vulnerabilities in the protocol that enable the application of exploits such as POODLE attacks. Although SSLv3 is enabled and supported by the different providers, most of the applications discouraged the use. Therefore, _SSLv3_  
Figure 8: Feature Model of Apache Server. is discouraged and it was removed in the model. _TLSv1_ or _TLSv1.1_ are weak versions, but they are still being used because some suppliers and customers support these protocols, although the end of the support is announced for the year 2020. Client authentication (cf., _ClientAuth_) requires certain infrastructure, such as stores (cf., _Keystore_ and _Trust_) and digital certificates. As well, certain protocols allow the possibility of setting specific Cipher Suites (cf., _Ciphers_). An example of configuration is shown in Figure 9.  
The handshake of protocol _SSL/TLS_ is based on this sequence of steps: (1) Negotiation of the _Cipher Suite_ to be used during the transfer, and generation and exchange of a random number (master key); (2) Set and exchange a session identifier between client and server; (3) Authentication of the server to the client; (4) Authentication of the client to the server. The handshake has been simplified in _TLS_ version 1.3. _SSL/TLS_ enables the authentication of the client and the server, and anonymous communication. Authentication is done through digital signatures, such as digital certificates or keys. The digital certificates must be vouched for as validated by a Certificate Authority (CA). _SSLv3_ and _TLSv1.0_ protocols also enable anonymous authentication based on _Diffie-Hellman_ key exchange. The _SSL/TLS_ model is shown in Figure 10 and it is a complete model where all the features for configuring the cipher suites are available for versions _TLS1.2_ (TLS version 1.2 RFC 5246: [[https://tools.ietf.org/html/rfc5246](https://tools.ietf.org/html/rfc5246)]([https://tools.ietf.org/html/rfc5246](https://tools.ietf.org/html/rfc5246))) and _TLS1.3_ (TLS version 1.3 RFC 8446: [[https://tools.ietf.org/html/rfc8446](https://tools.ietf.org/html/rfc8446)]([https://tools.ietf.org/html/rfc8446](https://tools.ietf.org/html/rfc8446))). All previous versions are considered unsafe and they have been removed of the model. This model can be linked to _Apache_ Model (Figure 8) by the feature _Ciphers_. The _SSL/TLS_ model represents the attributes to configure certificates, key-stores, ciphers, key sizes on the use of any _SSL/TLS_ protocol version.