better https defaults

diff --git a/pound.cfg b/pound.cfg
index 65785f063da88411654ff4c4bb78dfe3722718e5..f058d33015182b06998929a32ece39d7f22d9039 100644 (file)
--- a/pound.cfg
+++ b/pound.cfg
@@ -35,6 +35,13 @@ ListenHTTPS
        Address 0.0.0.0
        Port 443
        Cert "/etc/pki/pound.pem"
+
+       Disable SSLv3
+       SSLAllowClientRenegotiation 0
+       SSLHonorCipherOrder 1
+       Ciphers "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
+       AddHeader  "HTTPS: on"
+       RewriteLocation 0
 End
 
 Service