X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fapache2%2Ffiles%2Fpuppet-config;h=d754b1241608cc3a4b9e7b1e60e5601f4a6c1e19;hb=e8d6b1f683b7538b9e17602c5e3d1022f3722894;hp=40d6d70428e5cfe447749649170b0116b8547076;hpb=d42b232629e0f6dc147bc53d940493467d3852d2;p=mirror%2Fdsa-puppet.git

diff --git a/modules/apache2/files/puppet-config b/modules/apache2/files/puppet-config
index 40d6d7042..d754b1241 100644
--- a/modules/apache2/files/puppet-config
+++ b/modules/apache2/files/puppet-config
@@ -1,3 +1,8 @@
 <IfModule mod_ssl.c>
   SSLProtocol all -SSLv2 -SSLv3
+  SSLHonorCipherOrder On
+
+  # this is a list that seems suitable as of 2014-10, when running wheezy.  It
+  # probably requires re-visiting regularly.
+  SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
 </IfModule>