SSL Server Supports Weak Encryption Vulnerability

[qpidity]

Hi,

We're trying to tighten security for PCI Compliance but this particular item 38142 SSL Server Allows Anonymous Authentication VulnerabilitySSL Server Allows Anonymous Authentication Vulnerability is providing problematic so I was hoping someone could offer some advice.

The advice provided in the vulnerabilities report to resolve this item is the following:

Typically, for Apache/mod_ssl, httpd.conf or ssl.conf should have the following lines:
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
For Apache/apache_ssl include the following line in the configuration file (httpsd.conf):
SSLRequireCipher ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

The SSLProtocol and SSLCipherSuite directives were added in both /etc/httpd/conf.d/ssl.conf and /etc/httpd/conf/httpd.conf and then the web service restarted.

SSLRequireCipher was initially also added but caused the service not to restart so was removed.

After doing this we were advised once again that we've failed this vulnerability which is frustrating to say the least.

Has anyone had similar issues who could offer advice?

Thanks in advance