By default, disable SSL3_RSA_WITH_DES_CBC_SHA.

* TRAC Ticket #706 - Disable SSL3_RSA_WITH_DES_CBC_SHA
dogtagpki · Aug 20, 2013 · 443bffb · 443bffb
1 parent 5ecf890
commit 443bffb
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py
@@ -794,7 +794,7 @@ def compose_pki_master_dictionary(self):
                     "+SSL3_RSA_WITH_RC4_128_SHA," + \
                     "-SSL3_RSA_EXPORT_WITH_RC4_40_MD5," + \
                     "+SSL3_RSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "+SSL3_RSA_WITH_DES_CBC_SHA," + \
+                    "-SSL3_RSA_WITH_DES_CBC_SHA," + \
                     "-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5," + \
                     "-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA," + \
                     "-SSL_RSA_FIPS_WITH_DES_CBC_SHA," + \

diff --git a/base/setup/pkicreate b/base/setup/pkicreate
@@ -2432,7 +2432,7 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
                                           . "-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5";
         $slot_hash{$TOMCAT_SSL3_CIPHERS}       = "-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,"
                                           . "+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,"
-                                          . "+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,"
+                                          . "+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,"
                                           . "-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,"
                                           . "-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,"
                                           . "-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,"