Issue 299 and issue 385 - Drop support for RC4 and support IE6/WinXP clients

modules/nginx/templates/nginx.conf.erb

 user <%= scope.lookupvar('nginx::params::user') %> <%= scope.lookupvar('nginx::params::group') %>;
 worker_processes <%= worker_processes %>;
 
 error_log /var/log/nginx/error.log notice;
 pid /var/run/nginx.pid;
 
 events {
   worker_connections <%= worker_connections %>;
   <% if scope.lookupvar('nginx::params::multi_accept') == 'on' %>multi_accept on;<% end %>
 }
@@ skipping 21 matching lines @@
   tcp_nodelay <%= scope.lookupvar('nginx::params::tcp_nodelay') %>;
 
   <% if scope.lookupvar('nginx::params::gzip') == 'on' %>
   gzip on;
   gzip_disable "msie6";
   gzip_min_length 100;
   gzip_buffers 4 8k;
   gzip_types text/plain text/xhtml text/css application/x-javascript text/xml application/atom+xml application/rss+xml;
   <% end %>
 
-  ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS !RC4 +3DES DES-CBC3-SHA";

[Felix Dahlke, 2014/04/26 22:19:47]

After figuring out how this works, I think it'd be more logical to move
DES-CBC3-SHA in front of !aNULL, wouldn't it?

Then we'd first have the supported suites, then the forbidden suites and finally
3DES at the end of the list.

[Wladimir Palant, 2014/04/27 20:35:34]

You are right, I did that. I also decided to change +3DES into -3DES - this way
we include only the one 3DES-based cipher that we need for IE support rather
than all of them.

+  ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA -3DES DES-CBC3-SHA !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS !RC4";
   ssl_prefer_server_ciphers on;
   ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
   <% if ssl_session_cache == 'on' %>
   ssl_session_cache shared:SSL:1m;
   <% else %>
   ssl_session_cache off;
   <% end %>
 
   types_hash_max_size 2048;
 
   server_names_hash_bucket_size 64;
 
   include /etc/nginx/conf.d/*.conf;
   include /etc/nginx/sites-enabled/*;
 }