Update cipher suites

[fschaer]

This change is needed as puppetlabs is allowing only (non ?)-DH ciphers in puppetdb6, which in turn causes connectivity failures between puppet server and puppetdb if no common cipher is found. Unfortunately, changing the puppet server ciphers is not enough, setting the puppetdb ciphers is also necessary to make sure all communications are ok - this was added in the README in the puppetdb integration section as this change has to be done outside this module.

Fixes GH-714

[noqqe]

I can reproduce the behavior. PuppetDB >6.7.2 does not support the ciphers that are being configured by the module.

Edit:

Workaround until this PR gets merged:

class { '::puppet':
  [...]
  server_reports              =>  'store',
  server_storeconfigs_backend => 'puppetdb',
  server_cipher_suites        => [
      'TLS_DHE_RSA_WITH_AES_128_GCM_SHA256',
      'TLS_DHE_RSA_WITH_AES_256_GCM_SHA384',
      'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
      'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
      'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
      'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
  ],
}

[ekohl]

The TLS_RSA ciphers are vulnerable to the ROBOT attack. Should we remove those while we're at it? That's probably also the reason why PuppetDB fails to talk to theforeman-puppet now.

[mmoll]

-> GH-721