From 6572b94bc6cfb41463edd9dc9d6f85cf0f04aa57 Mon Sep 17 00:00:00 2001
From: Stefan Fritsch <sf@apache.org>
Date: Mon, 13 Jun 2011 19:30:05 +0000
Subject: [PATCH] AFAICS, we don't have a default cipher suite but depend on
 openssl's default. Document the fact that this default depends on the openssl
 version. Recommend !aNULL over !ADH, because the former also excludes !AECDH
 in openssl 1.0+

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1135241 13f79535-47bb-0310-9956-ffa450edef68
---
 docs/manual/mod/mod_ssl.xml   | 7 ++++---
 docs/manual/ssl/ssl_howto.xml | 8 ++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index b86528d30d..43d3625909 100644
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -614,7 +614,7 @@ SSLProtocol all -SSLv2
 <description>Cipher Suite available for negotiation in SSL 
 handshake</description>
 <syntax>SSLCipherSuite <em>cipher-spec</em></syntax>
-<default>SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</default>
+<default>SSLCipherSuite DEFAULT (depends on OpenSSL version)</default>
 <contextlist><context>server config</context>
 <context>virtual host</context>
 <context>directory</context>
@@ -711,9 +711,10 @@ prefixes are:</p>
 <p>A simpler way to look at all of this is to use the ``<code>openssl ciphers
 -v</code>'' command which provides a nice way to successively create the
 correct <em>cipher-spec</em> string. The default <em>cipher-spec</em> string
-is ``<code>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code>'' which
+depends on the version of the OpenSSL libraries used. Let's suppose it is
+``<code>ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code>'' which
 means the following: first, remove from consideration any ciphers that do not
-authenticate, i.e. for SSL only the Anonymous Diffie-Hellman ciphers. Next,
+authenticate, i.e. for SSL the Anonymous Diffie-Hellman ciphers. Next,
 use ciphers using RC4 and RSA. Next include the high, medium and then the low
 security ciphers. Finally <em>pull</em> all SSLv2 and export ciphers to the
 end of the list.</p>
diff --git a/docs/manual/ssl/ssl_howto.xml b/docs/manual/ssl/ssl_howto.xml
index 6a214e231c..9c787f87a0 100644
--- a/docs/manual/ssl/ssl_howto.xml
+++ b/docs/manual/ssl/ssl_howto.xml
@@ -67,7 +67,7 @@ only?</title>
     <p>The following enables only the strongest ciphers:</p>
     <example><title>httpd.conf</title>
       SSLProtocol all -SSLv2<br />
-      SSLCipherSuite HIGH:!ADH:!EXP:!MD5:!NULL<br />
+      SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL<br />
     </example>
 
     <p>While with the following configuration you enable two ciphers
@@ -75,7 +75,7 @@ only?</title>
 
     <example><title>httpd.conf</title>
       SSLProtocol all -SSLv2<br />
-      SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!ADH:!EXP:!MD5:!NULL<br />
+      SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!EXP:!MD5:!NULL<br />
       SSLHonorCipherOrder on
     </example>
 
@@ -96,12 +96,12 @@ URL?</title>
     This can be done as follows:</p>
     <example>
       # be liberal in general<br />
-      SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL<br />
+      SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL<br />
       <br />
       &lt;Location /strong/area&gt;<br />
       # but https://hostname/strong/area/ and below<br />
       # requires strong ciphers<br />
-      SSLCipherSuite HIGH:!ADH:!EXP:!MD5:!NULL<br />
+      SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL<br />
       &lt;/Location&gt;
     </example>
 </section>
-- 
2.40.0