I submitted my LAMP server (redhat os) for two PCI compliance scans. The first scan resulted in 3 SSL errors. They were:
- SSL Server Supports Weak Encryption for SSLv3, TLSv1
- SSL Server Supports Weak MAC Algorithm for SSLv3, TLSv1
- SSL Server Supports CBC Ciphers for SSLv3, TLSv1
The PCI scan report suggested some solutions, which I took in creating a SSLCipherSuite to address the issue. This is the resulting SSLCipherSuite
However, this SSLCipherSuite still failed issue 3. The operator of the PCI Scan emailed me afterwards saying that i have to remove anything CBC based (such as DES). The operator said he's frequently seen leaving RC4-AES as the available cipher as an acceptable solution.
So I took his suggestion and tried
But this caused an error with apache and it wouldn't start up again. What is the correct directive to do as the operator suggest?