- log notice giving SELinux context at startup if enabledhttpd-2_0_54-15

- drop SSLv2 and restrict default cipher suite in default SSL configuration

1 files changed, 12 insertions, 7 deletions

diff --git a/ssl.conf b/ssl.conf
index f489c66..738ae3b 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -99,16 +99,21 @@ LogLevel warn
 #   Enable/Disable SSL for this virtual host.
 SSLEngine on
 
+#   SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect.  Disable SSLv2 access by default:
+SSLProtocol all -SSLv2
+
 #   SSL Cipher Suite:
-#   List the ciphers that the client is permitted to negotiate.
-#   See the mod_ssl documentation for a complete list.
-SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
+# List the ciphers that the client is permitted to negotiate.
+# See the mod_ssl documentation for a complete list.
+SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
 
 #   Server Certificate:
-#   Point SSLCertificateFile at a PEM encoded certificate.  If
-#   the certificate is encrypted, then you will be prompted for a
-#   pass phrase.  Note that a kill -HUP will prompt again.  A new
-#   certificate can be generated using the genkey(1) command.
+# Point SSLCertificateFile at a PEM encoded certificate.  If
+# the certificate is encrypted, then you will be prompted for a
+# pass phrase.  Note that a kill -HUP will prompt again.  A new
+# certificate can be generated using the genkey(1) command.
 SSLCertificateFile /etc/pki/tls/certs/localhost.crt
 
 #   Server Private Key: