Use more secure OpenSSL default ciphers

This makes sure we don't use weak ciphers when connecting to services
that run over SSL.

Author: dbussink

ext/openssl/lib/openssl/ssl.rb

@@ -20,13 +20,19 @@
 module OpenSSL
   module SSL
     class SSLContext
+      options = OpenSSL::SSL::OP_ALL
+      if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS)
+        options &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
+      end
+      if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
+        options |= OpenSSL::SSL::OP_NO_COMPRESSION
+      end
+
       DEFAULT_PARAMS = {
         :ssl_version => "SSLv23",
         :verify_mode => OpenSSL::SSL::VERIFY_PEER,
-        :ciphers => "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW",
-        :options => defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) ?
-          OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS :
-          OpenSSL::SSL::OP_ALL,
+        :ciphers => "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2:!ADH",
+        :options => options,
       }
 
       DEFAULT_CERT_STORE = OpenSSL::X509::Store.new