These settings are giving me an A+ on SSLLabs.com... # - Apache 2.4 PFS & BEAST attack Safe /etc/apache2/mods-enabled/ssl.conf SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH SSLHonorCipherOrder on SSLCompression off # - HSTS Apache directive to force…
Note that you shouldn't send the STS header for http:// responses:
http://tools.ietf.org/html/rfc6797#section-7.2