#!/bin/bash
#$Id: fix_ssl.bash,v 1.9 2020/09/16 08:34:41 sofc Exp $
SSL=`locate ssl.conf | grep httpd | grep conf.d | grep -P 'ssl.conf\$'`
echo $SSL
centos=`uname -r | perl -ne '/(el\d)/; print $1,"\n"'`
if grep -Fxq "SSLProtocol all -SSLv2 -SSLv3" $SSL
    then
    echo "SSL ver3 disabled"
else
    echo "Trying to fix SSL"
    if grep -Fxq "SSLProtocol all -SSLv2" $SSL
	then
	echo "Adding -SSLv3"
	sed -i 's/^SSLProtocol all -SSLv2/SSLProtocol all -SSLv2 -SSLv3/g' $SSL 
    else
	if  grep -Fxq "SSLProtocol all" $SSL
	    then
	    echo "Adding -SSLv2 -SSLv3"
	    sed -i 's/^SSLProtocol all/SSLProtocol all -SSLv2 -SSLv3/g' $SSL 
	else
	    if [ "$centos" == "el8" ]; then
		echo "SSL not found (on centOS8 this is not a problem)"
            else
		echo "SSL not found!"
		exit 1;
            fi
	fi
    fi
    /sbin/service httpd restart
    sleep 5
fi
if grep -Fxq "SSLCipherSuite HIGH:!aNULL:!MD5" $SSL
    then
    echo "SSL cipher ok"
else
    echo "disabling weak ciphers"
    sed -i 's/^SSLCipherSuite .*/SSLCipherSuite HIGH:!aNULL:!MD5/g' $SSL 
    /sbin/service httpd restart
    sleep 5
fi


