<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:arial,helvetica,sans-serif;font-size:12pt">><br><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt;"><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><div>> It's not so bad. I added the following to my apache2 config to fix<br>> some SSL issues:<br>><br>> SSLProtocol all -SSLv2<br>> SSLCipherSuite<br>> ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-eNULL<br>><br>> - Grant<br><br>Hi Grant,<br><br>Who did you use for the PCI DSS Compliance testing? My CC Processor forces me to use Trustwave, who supposedly is one if not the biggest. They are a pain to work with. <br><br>I have used the setup you suggested but they reject it as Non-compliant and will not give any
more info. They say they require SSLProtocol -ALL +SSLv3 +TLSv1 Do you see any problems with this. Sorry but I do not trust Trustwave, they keep finding to many things that are just not on my server, or they reject their own suggestions as to weak. I found a independent Website to test for SSLv2 and SSLv3 and they say we no longer use SSLv2 but Trustwave wants more. I certainly do not want to loose customers but it sounds like most new Browsers can handle the SSLv3. Any thoughts?<br><br>Thank you<br><br>Kyle<br><a rel="nofollow" target="_blank" href="http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_2"></a></div></div></div></div>
</div><br>
</body></html>