SSL-config is not secure enough

[iXware71]

The apache ssl config is not secure enough. The ssl test at https://ssllabs.com/ssltest only gives an overall rating of "B".

Please check https://bettercrypto.org/#_apache for better apache configuration.

The "header" parameters are not necessary for a better rating, but the parameters SSLProtocol and SSLCipherSuite are important.

Add this in /etc/apache2/sites-available/000-default.conf before line "</VirtualHost>":

SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On
SSLCompression off

SSLCipherSuite EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'

[ckulka]

Hi @iXware71 , I'll add it to Apache (and also checl the nginx settings) in the next release, thanks!

[ckulka]

Closing this issue given this is fixed in master and will be part of the next release version of Baikal.

Thanks again @iXware71 to point it out 👍