Bug#943415: apache2: Disable TLS 1.0 and 1.1 by default

[David Prévot <taffit@debian.org>]

Hi,

Le Thu, Oct 24, 2019 at 05:50:50PM +0200, Kurt Roeckx a écrit :
> Package: apache2
> Version: 2.4.38-3
> 
> Hi,
> 
> I was expecting TLS 1.0 and 1.1 to be disabled

Same here. Four years later, RFC 8996 (Deprecating TLS 1.0 and TLS 1.1)
has been published and most clients have been updated, so could we
please review the default SSLProtocol before Trixie gets released? 

> Could you change the default to:
> SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

Regards,

taffit

Attachment: signature.asc
Description: PGP signature