Update apache2 cipher preferences from https://mozilla.github.io/server-side-tls...

diff --git a/modules/apache2/templates/puppet-config.erb b/modules/apache2/templates/puppet-config.erb
index 9a7cdaf..1299843 100644 (file)
--- a/modules/apache2/templates/puppet-config.erb
+++ b/modules/apache2/templates/puppet-config.erb
@@ -4,11 +4,11 @@
 
   # this is a list that seems suitable as of 2014-10, when running wheezy.  It
   # probably requires re-visiting regularly.
-  <% if scope.call_function('versioncmp', [@lsbmajdistrelease, '7']) <= 0 -%>
-    SSLCipherSuite ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
-  <% else -%>
-    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!RC4:!SEED:!DSS
-  <% end -%>
+  # 2017-07-02
+  #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.18&openssl=1.0.1p&hsts=no&profile=intermediate
+  #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.25&openssl=1.0.1p&hsts=no&profile=intermediate
+  #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.25&openssl=1.1.0f&hsts=no&profile=intermediate
+  SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
 
   <%- if has_variable?("apache2deb9") && @apache2deb9 -%>
     SSLUseStapling On
@@ -26,6 +26,7 @@
 
     SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling(1048576)
     SSLStaplingReturnResponderErrors off
+    SSLStaplingResponderTimeout 5
     SSLStaplingFakeTryLater off
   <% end -%>
 </IfModule>