|
 |
52592b |
diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
|
|
|
52592b |
index 4cfd2d0..6ac55bd 100644
|
|
|
52592b |
--- a/modules/ssl/ssl_engine_config.c
|
|
|
52592b |
+++ b/modules/ssl/ssl_engine_config.c
|
|
|
52592b |
@@ -776,9 +776,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
|
|
|
52592b |
}
|
|
|
52592b |
|
|
|
52592b |
if (!strcmp("SSL", arg1)) {
|
|
|
52592b |
- /* always disable null and export ciphers */
|
|
|
52592b |
- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
52592b |
if (cmd->path) {
|
|
|
52592b |
+ /* Disable null and export ciphers by default, except for PROFILE=
|
|
|
52592b |
+ * configs where the parser doesn't cope. */
|
|
|
52592b |
+ if (strncmp(arg2, "PROFILE=", 8) != 0)
|
|
|
52592b |
+ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
52592b |
dc->szCipherSuite = arg2;
|
|
|
52592b |
}
|
|
|
52592b |
else {
|
|
|
52592b |
@@ -1542,8 +1544,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
|
|
|
52592b |
}
|
|
|
52592b |
|
|
|
52592b |
if (!strcmp("SSL", arg1)) {
|
|
|
52592b |
- /* always disable null and export ciphers */
|
|
|
52592b |
- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
52592b |
+ /* Disable null and export ciphers by default, except for PROFILE=
|
|
|
52592b |
+ * configs where the parser doesn't cope. */
|
|
|
52592b |
+ if (strncmp(arg2, "PROFILE=", 8) != 0)
|
|
|
52592b |
+ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
52592b |
dc->proxy->auth.cipher_suite = arg2;
|
|
|
52592b |
return NULL;
|
|
|
52592b |
}
|