Attachment 6677 Details for Bug 37566

[patch] Patch adding more fine-grained configuration of mod_ssl

ssl.conf.patch1 (text/plain), 1.54 KB, created by Lutz Willek on 2015-02-15 20:19 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Lutz Willek

Created: 2015-02-15 20:19 CET

Size: 1.54 KB

patch

obsolete

>83a84,102
>> #   SSLProtocol
>> #   This directive can be used to control the SSL protocol flavors mod_ssl should use when 
>> #   establishing its server environment. 
>> #   Clients then can only connect with one of the provided protocols.
>> #   Default: SSLProtocol all -SSLv2 -SSLv3
>> #   SSLv3
>> #      This is the Secure Sockets Layer (SSL) protocol, version 3.0, from the Netscape Corporation.
>> #      It is the successor to SSLv2 and the predecessor to TLSv1. It's supported by almost all browsers.
>> #      Setting UCR variable apache2/ssl/v3 to "True" enables SSLv3 (default: disabled)
>> #   TLSv1
>> #      Transport Layer Security (TLS) protocol, version 1.0.
>> #      It is the successor to SSLv3 and is defined in RFC 2246.
>> #      Setting UCR variable apache2/ssl/tlsv1 to "False" disables TLSv1 (default: enabled)
>> #   TLSv1.1
>> #      A revision of the TLS 1.0 protocol, as defined in RFC 4346.
>> #      Setting UCR variable apache2/ssl/tlsv11 to "False" disables TLSv1.1 (default:enabled)
>> #   TLSv1.2
>> #      A revision of the TLS 1.0 protocol, as defined in RFC 5246.
>> #      Setting UCR variable apache2/ssl/tlsv12 to "False" disables TLSv1.2 (default:enabled)
>87a107,115
>> if configRegistry.get('apache2/ssl/tlsv1'):
>> 	if configRegistry.is_false('apache2/ssl/tlsv1'):
>> 		protocol += ' -TLSv1'
>> if configRegistry.get('apache2/ssl/tlsv11'):
>> 	if configRegistry.is_false('apache2/ssl/tlsv11'):
>> 		protocol += ' -TLSv1.1'
>> if configRegistry.get('apache2/ssl/tlsv12'):
>> 	if configRegistry.is_false('apache2/ssl/tlsv12'):
>> 		protocol += ' -TLSv1.2'

Actions: View | Diff

Attachments on bug 37566: 6676 | 6677