Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of arekm@maven.pl designates
 209.85.212.173 as permitted sender)
From: Arkadiusz =?utf-8?q?Mi=C5=9Bkiewicz?= <arekm@maven.pl>
To: dev@httpd.apache.org
Subject: Re: Disable SSLv3 by default
Date: Fri, 17 Oct 2014 20:57:14 +0200
User-Agent: KMail/1.13.7 (Linux/3.16.4; KDE/4.14.2; x86_64; ; )
References: 
 <CAL1qwc_5ERd+3b9=uApjB0nqfvGZ4K+14zamtdsqDHyqm_UmwA@mail.gmail.com>
 <5441511D.1070201@velox.ch>
In-Reply-To: <5441511D.1070201@velox.ch>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <201410172057.14850.arekm@maven.pl>

On Friday 17 of October 2014, Kaspar Brand wrote:
> On 17.10.2014 12:02, Takashi Sato wrote:
> > SSLv3 is now insecure (CVE-2014-3566, POODLE)
> > Let's disable SSLv3 by default, at least trunk.
> >=20
> > SSLProtocol default is "all".
> > <http://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslprotocol>
> > "all" means "a shortcut for ``+SSLv3 +TLSv1'' or - when using OpenSSL
> > 1.0.1 and later - ``+SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, respectively."
> >=20
> > Should we remove SSLv3 from "all" ?
>=20
> From a semantic point of view, I wouldn't do that. As long as we still
> allow SSLv3 to be used, "all" should really mean "all protocols which
> can be enabled in mod_ssl".

Then add "safe" option (leaving "all" as is) and make "safe" default. safe=
=20
would point to known safe protocols at release time.

> Kaspar


=2D-=20
Arkadiusz Mi=C5=9Bkiewicz, arekm / ( maven.pl | pld-linux.org )