I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable.
The following list works for me, and gets me an A on SSLLabs.
SSLProtocol -all +TLSv1.2 SSLHonorCipherOrder On SSLCipherSuite ECDH+AESGCM:DH+AESGCM:RSA+AESGCM:!aNULL:!MD5:!DSS:!LOW:!MEDIUM
My problem is that I cannot add any more without getting an F, and being open to the Padding Oracle in question.
If I then compare this to the results of a security heavy website like http://binance.com. They get A+ AND they have CBC ciphers present.
My question then, how can I protect against OpenSSL Padding Oracle (CVE-2016-2107), whilst enabling more ciphers? Is there more configuration I can do elsewhere to protect, whilst allowing a larger range of ciphers (WEAK or not)? I also see that TLSv1.0 and TLSv1.1 can also be enabled with a limited range of ciphers too.****
My reasoning here is that my current list is preventing Safari 6-8, Android 2-4, and Windows 7 IE 8-10 users. I'd like to open this up.