Merge pull request #895 from tskirvin/master

Turning off SSLv3 by default, re: CVE-2014-3566 (POODLE SSL vuln.)
xbezdick · Oct 16, 2014 · e69a892 · e69a892
2 parents 8e94543 + f8953f7
commit e69a892
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -1781,7 +1781,7 @@ Specifies the SSL certification. Defaults are based on your OS: '/etc/pki/tls/ce
 
 Specifies [SSLProtocol](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslprotocol). Defaults to 'undef'. 
 
-If you do not use this parameter, it uses the HTTPD default from ssl.conf.erb, 'all -SSLv2'.
+If you do not use this parameter, it uses the HTTPD default from ssl.conf.erb, 'all -SSLv2 -SSLv3'.
 
 #####`ssl_cipher`
 

diff --git a/templates/mod/ssl.conf.erb b/templates/mod/ssl.conf.erb
@@ -21,7 +21,7 @@
   SSLCryptoDevice builtin
   SSLHonorCipherOrder On
   SSLCipherSuite <%= @ssl_cipher %>
-  SSLProtocol all -SSLv2
+  SSLProtocol all -SSLv2 -SSLv3
 <% if @ssl_options -%>
   SSLOptions <%= @ssl_options.compact.join(' ') %>
 <% end -%>