Editing Apache Hardening (section)

== SSL Protocols and Ciphers ==
Recommended SSL protocols and ciphers will change over time as new protocols/ciphers become available and older ones become considered as weak.  You want to make sure that you are using the strongest protocols and ciphers but if you only use these then some browsers may not be able to access you EPrints repositories.  Ensuring the correct balance is important.  The following lines should be added to your archive's HTTPS virtualhost (i.e. in the archive's ''ssl/securevhost.conf''):
 SSLHonorCipherOrder on
 SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
However, over time some of these protocols or ciphers may come to be considered weak.  You should periodically check you EPrints repository on https://www.ssllabs.com/ssltest/.  If you get an A grade or above then your protocol/cipher choice is still OK. (To get an A+ grade you need [[#HTTP Strict Transfer Protocol (HSTS)|HSTS]] enabled).  If you get less than an A grade, the report produced should tell you which protcols and ciphers you need to disable and possibly which newer one you should enable.