Topic: Disable MEDIUM and WEAK Ciphers with Apache HTTPS?

[superwormy]

For a PCI compliance scan from SecurityMetrics.com, I need to disable MEDIUM and WEAK Ciphers in Apache. I know that with a normal Apache configuration, I just need to set this:
 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!MEDIUM:!EXP:RC4+RSA:+HIGH

What do I need to do to SME Server to make that happen? I'm also supposed to disable SSLv2.

[cactus]

For a PCI compliance scan from SecurityMetrics.com, I need to disable MEDIUM and WEAK Ciphers in Apache. I know that with a normal Apache configuration, I just need to set this:
 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!MEDIUM:!EXP:RC4+RSA:+HIGH

What do I need to do to SME Server to make that happen? I'm also supposed to disable SSLv2.

IIRC the latest updates should disable some of the cipher suits for you as a bug for that has been fixed recently.

The general solution to this is to create a copy of the affected template fragment, modify the copy to your likings, regenerate the configuration file and restart affected services. A more detailed explanation is given here: http://wiki.contribs.org/Template_Tutorial

All the technical details can be found in the Developers Guide: http://wiki.contribs.org/SME_Server:Documentation:Developers_Manual#Configuration_file_templates