sbadia/puppet-gitlab — pull request #104 by atomaka (2013-12-18 22:30:56+00:00)
Title: WIP: Harden SSL Configuration

This pull request is currently a work in progress and should not yet be merged.

As noted in issue #103, our SSL configuration is currently insecure. Specifically, aNULL ciphers must be excluded in our configuration. Along with ssl_prefer_server_ciphers (which we have already set), this should protect us from exploits similar to the BEAST attack. Including SSLv3 seems to be fine according to resources I have skimmed.

That said, I am not fluent with SSL certificates and would like input from @igalic and others on the topic.

References:
* http://nginx.org/en/docs/http/configuring_https_servers.html
* http://www.hybridforge.com/blog/nginx-ssl-ciphers-and-pci-compliance