--- file_not_specified_in_diff +++ file_not_specified_in_diff @@ -84,0 +84,19 @@ +# SSLProtocol +# This directive can be used to control the SSL protocol flavors mod_ssl should use when +# establishing its server environment. +# Clients then can only connect with one of the provided protocols. +# Default: SSLProtocol all -SSLv2 -SSLv3 +# SSLv3 +# This is the Secure Sockets Layer (SSL) protocol, version 3.0, from the Netscape Corporation. +# It is the successor to SSLv2 and the predecessor to TLSv1. It's supported by almost all browsers. +# Setting UCR variable apache2/ssl/v3 to "True" enables SSLv3 (default: disabled) +# TLSv1 +# Transport Layer Security (TLS) protocol, version 1.0. +# It is the successor to SSLv3 and is defined in RFC 2246. +# Setting UCR variable apache2/ssl/tlsv1 to "False" disables TLSv1 (default: enabled) +# TLSv1.1 +# A revision of the TLS 1.0 protocol, as defined in RFC 4346. +# Setting UCR variable apache2/ssl/tlsv11 to "False" disables TLSv1.1 (default:enabled) +# TLSv1.2 +# A revision of the TLS 1.0 protocol, as defined in RFC 5246. +# Setting UCR variable apache2/ssl/tlsv12 to "False" disables TLSv1.2 (default:enabled) @@ -88,0 +107,9 @@ +if configRegistry.get('apache2/ssl/tlsv1'): + if configRegistry.is_false('apache2/ssl/tlsv1'): + protocol += ' -TLSv1' +if configRegistry.get('apache2/ssl/tlsv11'): + if configRegistry.is_false('apache2/ssl/tlsv11'): + protocol += ' -TLSv1.1' +if configRegistry.get('apache2/ssl/tlsv12'): + if configRegistry.is_false('apache2/ssl/tlsv12'): + protocol += ' -TLSv1.2'