From cd4ec0661394781a8f23a0a2f093e035862c8f04 Mon Sep 17 00:00:00 2001
From: Peter Palfrader <peter@palfrader.org>
Date: Tue, 14 Oct 2014 22:58:02 +0200
Subject: [PATCH] Set ciphersuites

---
 modules/apache2/files/puppet-config | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/apache2/files/puppet-config b/modules/apache2/files/puppet-config
index 40d6d7042..3502beb85 100644
--- a/modules/apache2/files/puppet-config
+++ b/modules/apache2/files/puppet-config
@@ -1,3 +1,8 @@
 <IfModule mod_ssl.c>
   SSLProtocol all -SSLv2 -SSLv3
+  SSLHonorCipherOrder On
+
+  # this is a list that seems suitable as of 2014-10, when running wheezy.  It
+  # probably requires re-visiting regularly.
+  SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED
 </IfModule>
-- 
2.20.1