Probably like many others I am trying to prevent TLSv1 and TLSv1.1 from being used, mainly to meet PCI requirements. After doing a little research it seems I needed to insert the following line into the /usr/local/apache/conf.d/ssl.conf file
SSLProtocol all -SSLv3 -SSLv2 -TLSv1 -TLSv1.1
I restarted apache using the CWP dashboard but still get notifications that my site does support TLS1 and 1.1. Can anyone give me a pointer on next steps? If I make a typo on that line apache will not start so I know it is at least reading that file.
Should I be doing this somewhere else or in CWP??
Thanks,
wex