Sorry for my delay, it's been a rough beginning of the new year.
I thought that SSLv3 (Like SSLv1 & v2) was disabled by default in Apache, either 2.4.17 or 2.4.18 and 2.2.31. Yes, for 2.4.18 I see;
*) mod_ssl: Support compilation against libssl built with OPENSSL_NO_SSL3,
and change the compiled-in default for SSL[Proxy]Protocol to "all -SSLv3",
in accordance with RFC 7568. PR 58349, PR 57120. [Kaspar Brand]
It looks like this was not done in 2.2.31.
There has been a few problems with removing SSLv3. First OpenSSL would not compile with no-sslv3. Once that was fixed Apache would not compile when OpenSSL was compiled without SSLv3. This was also fixed as stated above.
The problem with SSLCipherSuite TLSv1.2!aNULL:!eNULL is as Mario stated, not all clients support TLSv1.2. My IE 9 on Vista will not connect with this. Vista is good till mid 2017 and aside from MS stating they are dropping support for IE 7, 8, 9 & 10 yesterday there are exceptions to it. The highest supported IE for the OS will be supported till the OS is EOL. For Vista that is IE9.
Mario's SSLCipherSuite will not connect http/2 on my Firefox, but I use the extended support release (currently 38.5.2) because I do not like the constant changes of the normal versions.
That said I will change the httpd-ahssl.conf file to;
SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:!RC4:!LOW:!MD5:!aNULL:!eNULL:!3DES:!EXP:!PSK:!SRP:!DSS
SSLHonorCipherOrder on
httpd-ahssl.conf was not meant to be perfect as things change quickly. As stated on line 2 of the file it is simply an "Demo Configuration for Apache Haus Distribution" and nothing more. User who are going to actually use HTTPS are responsible for keeping up on the issues concerning HTTPS.
