apache-httpd: harden default SSL cipher list

A couple of tweaks on the SSL cipher list.

Disabled RC4 which is now considered broken.
https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what

Enabled Forward Secrecy for modern browsers.
https://en.wikipedia.org/wiki/Forward_secrecy

Without the change, NixOS servers are capped at Grade B on
https://www.ssllabs.com/ssltest/index.html
This commit is contained in:
zimbatm 2015-10-04 22:13:50 +01:00
parent 1d3a4b17dd
commit f5f039eeb4

View file

@ -173,7 +173,8 @@ let
SSLRandomSeed connect builtin
SSLProtocol All -SSLv2 -SSLv3
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!EXP
SSLCipherSuite HIGH:!aNULL:!MD5:!EXP
SSLHonorCipherOrder on
'';