Merge pull request #941 from kyrofa/feature/616/ssl_revamp

apache: disable TLS 1.0 and 1.1 and strengthen ciphers

src/apache/conf/ssl.conf

@@ -40,8 +40,8 @@ LoadModule ssl_module modules/mod_ssl.so
 #   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
 #   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
 #   protocol or later should remain in use.
-SSLProtocol all -SSLv3
-SSLProxyProtocol all -SSLv3
+SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+SSLProxyProtocol all -SSLv3 -TLSv1 -TLSv1.1
 
 #   Pass Phrase Dialog:
 #   Configure the pass phrase gathering process.
@@ -93,7 +93,11 @@ SSLRandomSeed connect file:/dev/urandom 512
 
     SSLEngine on
     SSLHonorCipherOrder On
-    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;
+    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384
+
+    # Ensure perfect forward secrecy isn't compromised; the server doesn't
+    # necessarily restart regularly.
+    SSLSessionTickets off
 
     SSLCertificateFile      ${SNAP_DATA}/certs/live/cert.pem
     SSLCertificateKeyFile   ${SNAP_DATA}/certs/live/privkey.pem