Following advice I've seen here and other places, I am trying to remove support on our server for these two suites that flunk the SSL Labs Server test:
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
I would have thought that setting SSLCipherSuite to:
HIGH:!aNULL:!eNULL:!DES:!3DES:!ADH:!EXP:!NULL:!RC4
would disallow anything with 3DES, but SSL Labs test still shows these two "weak" ciphers as supported. I tried adding
:!DES-CBC3-SHA:!ECDHE-RSA-DES-CBC3-SHA
to that setting and doing a restart (Apache graceful), but it does not change.
SSLProtocol is set to:
-ALL -SSLv2 -SSLv3 +TLSv1.2
(is the -SSLv2 and v3 redundant?)
What am I missing?