From 673ee7b1e8fcdcce197d5099e90f93f316893b8d Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 19 Apr 2011 17:06:00 -0400
Subject: [PATCH] Harden SSL settings a bit.  Verified OK with @cmb and @billm

---
 etc/inc/system.inc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 2e640998d8..c55a0c0108 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -1086,6 +1086,11 @@ EOD;
 		$lighty_config .= "## ssl configuration\n";
 		$lighty_config .= "ssl.engine = \"enable\"\n";
 		$lighty_config .= "ssl.pemfile = \"{$g['varetc_path']}/{$cert_location}\"\n\n";
+
+		// Harden SSL a bit for PCI conformance testing
+		$lighty_config .= "ssl.use-sslv2 = \"disable\"\n";
+		$lighty_config .= "ssl.cipher-list = \"TLSv1+HIGH !SSLv2 RC4+MEDIUM !aNULL !eNULL !3DES @STRENGTH\"\n";
+
 		if(!(empty($ca) || (strlen(trim($ca)) == 0)))
 			$lighty_config .= "ssl.ca-file = \"{$g['varetc_path']}/{$ca_location}\"\n\n";
 	}