Webserver not as safe as expected?

Support
,
4

SSLv3 is disabled in httpd-admin instance, but not in httpd.
We use SSL configuration from upstream, you can freely change the /etc/httpd/conf.d/ssl.conf configuration file.

Probably you hit this bug (check for the workaround inside the issue itself):

Maybe it’s related to not very secure cipher suits.
You can change it using:

config setprop httpd SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
signal-event nethserver-httpd-update

Said this, we choose to stay compliant with upstream.
Do you think we should ship a more secure configuration of apache?

5 Likes