Check the link I posted previously. Some involve editing the cipher line because the specific services in question, which are third-party to cPanel, don't have protocol-level definitions. That is not something cPanel has control over. The instructions I posted are correct and verified by cPanel staff.
I agree entirely that if cPanel uses a third party service, and that service does not provide a way to configure the SSLProtocol, then cPanel cannot expose a setting that does not exist. (Unless, of course, they wish to compile these third party services themselves, building in that extra setting - for the last few releases, all those third party services have come through cPanel's own RPM mechanism for exactly this reason).
However, just because the SSLProtocol cannot be set, that doesn't then mean that changing the Cipher Suite becomes the correct answer. Because TLS1.0 and TLS1.1 are seen as using SSLv3 ciphers (without themselves being vulnerable to the poodle - they are TLS, after all), they would all be blocked. Anyone who restricted SSLv3 at the cipher level would find many more browsers shut out than just IE6 on Windows XP.
Just taking the relatively small list of browser tested by SSLLabs, the following would all be unnecessarily blocked from connecting to a site if the SSLv3 cipher was removed. There are, of course, many more. (I'm already seeing people saying that they're having trouble connecting to remote services from a JVM client, and I suspect it's because they've blocked too much).
(Of course, it may be that someone regards the risks of this so highly that they'd rather shut out all these clients than take the security risk, but that's a decision that only the server administrator can take - they need to be aware of the price before they go down this route).
- Android 2.3.7 No SNI 2 TLS 1.0
- Android 4.0.4 TLS 1.0
- Android 4.1.1 TLS 1.0
- Android 4.2.2 TLS 1.0
- Android 4.3 TLS 1.0
- BingBot Dec 2013 No SNI 2 TLS 1.0
- BingPreview Jun 2014 TLS 1.0
- Firefox 24.2.0 ESR / Win 7 TLS 1.0
- Googlebot Jun 2014 TLS 1.0
- IE 7 / Vista TLS 1.0
- IE 8 / XP No FS 1 No SNI 2 TLS 1.0
- IE 8-10 / Win 7 R TLS 1.0
- IE Mobile 10 / Win Phone 8.0 TLS 1.0
- Java 6u45 No SNI 2 TLS 1.0
- Java 7u25 TLS 1.0
- OpenSSL 0.9.8y TLS 1.0
- Safari 5.1.9 / OS X 10.6.8 TLS 1.0
- Safari 6.0.4 / OS X 10.8.4 R TLS 1.0
I've no intention of making this personal, Vanessa, since the same advice (block SSLv3 from the cipher list) is being given by many, many people. But I think people here would rather have a member of the cPanel team who are looking into POODLE come into this thread and confirm something as the right method, than have a general claim that "cPanel staff have looked into it and confirmed it's right".
Is there any chance you could contact those members of the cPanel staff and invite them to add their own comment to this thread? Would you mind letting us know who, at cPanel, has verified this to be the correct method? Again - I only ask because the advice is being given so frequently, and yet seems to be the wrong approach, not because I have an issue with you personally - you, like I, are trying to help.
