SSL/TLS 1.2 on Apache with openssl 1.0.1
I built and installed openssl 1.0.1. How do I force Apache to use TLS 1.2 Ciphers?
TLS 1.2 is covered in these 2 documents;
https://www.rfc-editor.org/rfc/rfc5246
https://www.rfc-editor.org/rfc/rfc6176
Basically the latter doc is Prohibiting SSL 2.0 from being negotiated by TLS1.2 and this is the default for httpd 2.2 shipped with fedora; eg SSLProtocol all -SSLv2
However your question was about CipherSuites which are also covered in those docs; By the looks of it, the only mandatory cipher suite for TLS 1.2 is TLS_RSA_WITH_AES_128_CBC_SHA
Appendix C. Cipher Suite Definitions
Cipher Suite Key Cipher Mac
Exchange
TLS_RSA_WITH_AES_128_CBC_SHA RSA AES_128_CBC SHA
This says that the server must provide an RSA certificate for key exchange, and that the cipher should be AES_128_CBC and the Mac SHA.
From the httpd mod_ssl docs, this translates to;
SSLCipherSuite aRSA:kRSA:AES128-CBC:SHA
which is documented here;
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslciphersuite