From 1c5896c3e32c1e85922fc63f1334bbec71a8ce76 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 20 Apr 2017 20:15:38 -0600 Subject: [PATCH] fix: be pci compliant by default Developers can override this in a custom nginx.conf.sigil. While it may be backwards incompatible - and will therefore require a minor release - it does make things much more secure. --- plugins/nginx-vhosts/install | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index abf9bf7b7..afb5074ca 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -37,7 +37,7 @@ server_tokens off; ssl_session_cache shared:SSL:20m; ssl_session_timeout 1d; -ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; +ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS; EOF fi