puppetlabs/puppet — pull request #2657 by haus (2014-05-15 21:33:21+00:00)
Title: (PUP-2177) Update example vhost SSL settings

Previously the example vhost defined an SSLCipherSuite which included
several weak ciphers. This commit updates the SSL settings in the vhost
in the following ways. First, SSLCipherSuite has includes disabling the
following suites (aNULL, eNULL, DES, 3DES, IDEA, SEED, DSS, PSK, RC4,
MD5). Second, previously LOW, SSLv2, and EXP were removed, but not
killed from the list, which meant that they could be added again in
subsequent declarations. This changes them from - to !, which kills them
instead of removes them. !ADH does not include AECDH, so instead we use
!aNULL, which excludes all anonymous ciphersuites.

SSLCompression is also set to off, because this defaults to on in
certain versions of httpd. Finally, SSLHonorCipherOrder is set to on,
because certain clients may send ciphers not in preferred order, and
this setting will help mitigate that problem.