Bug 1388068

Summary:	mod_ssl: Change default SSLProtocol value to +TLSv1.2 +TLSv1.1 in ssl.conf to support only secure TLS versions
Product:	Red Hat Enterprise Linux 7	Reporter:	David Jaša <djasa>
Component:	httpd	Assignee:	Luboš Uhliarik <luhliari>
Status:	CLOSED DUPLICATE	QA Contact:	BaseOS QE - Apps <qe-baseos-apps>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	luhliari, mfrodl
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-06 11:09:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description David Jaša 2016-10-24 11:18:28 UTC

Description of problem:
SSL 3.0 and TLS 1.0 are not considered secure anymore for quite some time so we should not listen on them

Version-Release number of selected component (if applicable):
mod_ssl-2.4.6-40.el7_2.4.x86_64

How reproducible:
always

Steps to Reproduce:
1. install httpd with mod_ssl on fresh RHEL 7 system
2. check SSLProtocol directive in /etc/httpd/conf.d/ssl.conf
3.

Actual results:
SSLProtocol all -SSLv2

Expected results:
SSLProtocol +TLSv1.2 +TLSv1.1
or
SSLProtocol all -SSLv2 -SSLv3 -TLSv1

Additional info:
related RHV bug (its TLS > 1.0 intolerance): Bug 1387996, similar bugs in other products may also appear.