Merge lp:~james-page/charm-helpers/fix-ssl-certs into lp:charm-helpers

[James Page]

Based on feedback from the OpenStack security team.

http://git.openstack.org/cgit/openstack/security-doc/tree/security-guide/source/secure-communication/tls-proxies-and-http-services.rst#n254

[lp:~james-page/charm-helpers/fix-ssl-certs]

535. By James Page on 2016-03-01

Drop session tickets

[Liam Young (gnuoy)]

review: Approve

=== modified file 'charmhelpers/contrib/openstack/templates/openstack_https_frontend'
--- charmhelpers/contrib/openstack/templates/openstack_https_frontend	2014-09-22 15:03:58 +0000
+++ charmhelpers/contrib/openstack/templates/openstack_https_frontend	2016-03-01 14:05:55 +0000
@@ -6,6 +6,8 @@
 <VirtualHost {{ address }}:{{ ext }}>
     ServerName {{ endpoint }}
     SSLEngine on
+    SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
+    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!EXP:!LOW:!MEDIUM
     SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert_{{ endpoint }}
     SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key_{{ endpoint }}
     ProxyPass / http://localhost:{{ int }}/