From 291c5c71327640a02218d7adda3e1013cd701b71 Mon Sep 17 00:00:00 2001 From: Peter Eckersley Date: Fri, 6 Nov 2015 12:42:13 -0800 Subject: [PATCH] Remove nonsensical Apache config directives - AcceptPathInfo Off was breaking things (fixes: #1274) - Enabling DEFLATE compression for HTML and XML may make the site vulnerable to BREACH! --- .../letsencrypt_apache/options-ssl-apache.conf | 6 ------ 1 file changed, 6 deletions(-) diff --git a/letsencrypt-apache/letsencrypt_apache/options-ssl-apache.conf b/letsencrypt-apache/letsencrypt_apache/options-ssl-apache.conf index 8c28c86a5..2a724d7ec 100644 --- a/letsencrypt-apache/letsencrypt_apache/options-ssl-apache.conf +++ b/letsencrypt-apache/letsencrypt_apache/options-ssl-apache.conf @@ -8,12 +8,6 @@ SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA25 SSLHonorCipherOrder on SSLCompression off - -ServerSignature Off -AcceptPathInfo Off -AddOutputFilterByType DEFLATE text/html text/plain text/xml application/pdf -AddDefaultCharset UTF-8 - SSLOptions +StrictRequire # Add vhost name to log entries: