On Tue, Dec 02, 2014 at 08:34:50AM -0800, Darren Pilgrim wrote: > On 12/1/2014 9:44 PM, Will Yardley wrote: > > On Mon, Dec 01, 2014 at 09:27:48PM -0800, Darren Pilgrim wrote: > >> On 12/1/2014 4:43 PM, Will Yardley wrote:
> >>> Can you use both ssl_protocols *and* ssl_cipher_list in the same config > >>> (in a way that's sane)? > >> > >> Yes to both. If you need to support older clients: > > But why does ssl_protocols behave differently depending on if > > $ssl_cipher_list is defined? Shouldn't !SSLv2 and !SSLv3 be sufficient? > > > > It seems that if ssl_cipher_list is defined, > > ssl_protocols = !SSLv2 !SSLv3 > > > > results in TLS1.2 being the only one active, but if it is defined, 1.0, > > 1.1, and 1.2 are all active? > > Where are you see this behaviour? What tool is reporting this? I have mostly been testing with nmap, e.g., nmap -p 993 --script ssl-enum-ciphers [target] This then breaks down the ciphers by protocol suite. I'll test with your ssl_cipher_list example and see if it's reproducible. w