Re: Apache gets SIGSEGV in ssl3_finish_mac()

[manu%netbsd.org@localhost (Emmanuel Dreyfus)]

Manuel Bouyer <bouyer%antioche.eu.org@localhost> wrote:

> > What about the SSLCipherSuite parameter? What do you have? 
> SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:
> +MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> (which is, I believe, the default value)

You have exactly the same value I have. I believe I got it from Apache
1.3 installations. Apache 2.2 documentation says that the default is now
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP'

ie: what we have, with EXPORT56 removed and eNULL not at the end. eNULL
is no encoding. Does that mean the default setup allows cleartext SSL
sessions???

--
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu%netbsd.org@localhost