title: Lighttpd: only SSLv3 enabled, but TLSv1.2 is used
body: <p>I have a Lighttpd-1.4.33 installation and have to prove the use of SSL and TLS. Therefore, I used the ssl.use-sslv3 and the ssl.cipher-suite parameter.<br>
  Please see my lighttpd.conf:</p>
  
  <pre><code>$SERVER["socket"] == ":443" {
  server.document-root = "/var/www/"
  server.protocol-http11 = "enable"
  ssl.engine = "enable"
  ssl.pemfile = "/etc/lighttpd/servercert.pem"
  ssl.ca-file = "/etc/lighttpd/cacert.pem"
  ssl.use-sslv3 = "enable"
  }
  </code></pre>
  
  <p>When I make a request it gives me a TLSv1.2 connection.<br>
  Now, ssl.use-sslv3 replaced with the following:</p>
  
  <pre><code>ssl.cipher-list = "NULL-MD5:NULL-SHA:EXP-RC4-MD5:RC4-MD5:RC4-SHA:DES-CBC3-SHA:AES128-SHA:AES256-SHA:EXP1024-RC4-SHA"
  ssl.honor-cipher-order = "enable"
  </code></pre>
  
  <p>also gives me a TLSv1.2 connection.</p>
  
  <p>So, my question is:<br>
  Is it correct that TLSv1.2 "includes" all ciphers which are used in SSLv3 and therefore its used instead of SSLv3?<br>
  Is there any chance to force Lighttpd to refuse TLSv1.2 connections but not SSLv3 if its configured that way?  </p>
  
  <p>It is necessary to me to be able to force Lighttpd to use only SSLv3 or TLSv1.0.<br>
  Thanks for any help.  </p>
  
  <p>The cipher-list is from <a href="http://www.openssl.org/docs/apps/ciphers.html#tls_v1_0_cipher_suites_" rel="nofollow">http://www.openssl.org/docs/apps/ciphers.html#tls_v1_0_cipher_suites_</a></p>