Disallow SSLv2, SSLv3 and TLS1.0 in rabbitmq for FedRAMP compliance
Disallow SSLv2, SSLv3 and TLS1.0 in rabbitmq for FedRAMP compliance

Only allow TLSv1.1 and TLSv1.2 when connecting to the AMQP port over SSL.

We cannot disable a specific protocol version for inter node communication,
so in order to enforce TLS1.1 or greater, we disallow all ciphers provided
by SSLv2 SSLv3 and TLS1.0.

Node: The list of allowed ciphers cannot be specified with the usual
OpenSSL cipher list format, so we pass the list of ciphers which are
available out of the default cipher list [1] used for other services like
HAProxy, stunnel or mysql/galera. The list is precomputed with:

openssl ciphers -v {cipher_list_format} | cut -d' ' -f 1 | paste -sd :

[1] !SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES:!SSLv3:!TLSv1

Change-Id: I354d5851345033a90b43e6be9a6039cb4edca203
Co-Authored-By: Michele Baldessari <47483730395cccb6448ad7313d5cedb48de25e40@acksyn.org>

openstack/puppet-tripleo,openstack/puppet-tripleo,openstack/puppet-tripleo