I have the following in httpd.conf that fixed it for all ports except the cpanel ports:
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
I tried all kinds of fixes but the issue with the cpanel ports existed. Then luckily found the instructions at
http://blog.serverbuddies.com/tag/pci-compliance-vulnerability/ and it worked! Here's what they suggest on that site:
--------------------------
In Apache common ports 80 and 443, you need to modify the SSLCipherSuite directive in the httpd.conf or ssl.conf file. An example would be editing the following lines to something like:
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
After you have done this, if you see you are still getting PCI Compliance vulnerability emails regarding to this issue its probably that cPanel is still allowing SSLv2 on their ports.
To quickly disable SSL version 2 on cPanel ports: 2082, 2083, 2086, 2087, 2095, 2096. You will need to do the following:
edit /var/cpanel/cpanel.config and change nativessl=1 to nativessl=0
This will make cPanel to use sTunnel.
edit /usr/local/cpanel/etc/stunnel/default/stunnel.conf
and add:
options = NO_SSLv2
just below the "Authentication stuff" tab.
After you have done all this you will need to restart cPanel:
/etc/init.d/cpanel restart
Done!
How to quickly check this?
SSH to your server and type the following commands
root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2096
root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2083
root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2087
root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2086
If everything is fine you should receive something like this,
root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2096
CONNECTED(00000003)
write:errno=104
