onehealth-cookbooks/apache2 — pull request #198 by svanzoest (2014-08-01 19:02:22+00:00)
Title: SSL updates

- Disabled SSL Protocol v2.0 and v3.0 (breaks Internet Explorer 6)
- Updated to a more modern default `apache.mod_ssl.cipher_suite`
- Added the following additional mod_ssl attributes
`apache.mod_ssl.honor_cipher_order`
`apache.mod_ssl.insecure_renegotiation`
`apache.mod_ssl.strict_sni_vhost_check`
`apache.mod_ssl.session_cache_timeout`
`apache.mod_ssl.compression`
`apache.mod_ssl.use_stapling`
`apache.mod_ssl.stapling_responder_timeout`
`apache.mod_ssl.stapling_return_responder_errors`
`apache.mod_ssl.stapling_cache`

For more information on these directives see
- https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy/
- https://www.insecure.ws/2013/10/11/ssltls-configuration-for-apache-mod_ssl/
- https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/