Blame SOURCES/httpd-2.4.35-sslciphdefault.patch

e71654
diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
e71654
index 4cfd2d0..6ac55bd 100644
e71654
--- a/modules/ssl/ssl_engine_config.c
e71654
+++ b/modules/ssl/ssl_engine_config.c
e71654
@@ -776,9 +776,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
e71654
     }
e71654
     
e71654
     if (!strcmp("SSL", arg1)) {
e71654
-        /* always disable null and export ciphers */
e71654
-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
e71654
         if (cmd->path) {
e71654
+            /* Disable null and export ciphers by default, except for PROFILE=
e71654
+             * configs where the parser doesn't cope. */
e71654
+            if (strncmp(arg2, "PROFILE=", 8) != 0)
e71654
+                arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
e71654
             dc->szCipherSuite = arg2;
e71654
         }
e71654
         else {
e71654
@@ -1542,8 +1544,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
e71654
     }
e71654
     
e71654
     if (!strcmp("SSL", arg1)) {
e71654
-        /* always disable null and export ciphers */
e71654
-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
e71654
+        /* Disable null and export ciphers by default, except for PROFILE=
e71654
+         * configs where the parser doesn't cope. */
e71654
+        if (strncmp(arg2, "PROFILE=", 8) != 0)
e71654
+            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
e71654
         dc->proxy->auth.cipher_suite = arg2;
e71654
         return NULL;
e71654
     }