Skip to content
Snippets Groups Projects
Commit 762f3eec authored by Stefan Galinski's avatar Stefan Galinski :video_game:
Browse files

[FEATURE] Add secure ssl settings

parent 6e87dfce
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
templates/default/vHost.conf.erb
+ 155
− 156
View file @ 762f3eec
<IfModule mod_ssl.c> <VirtualHost _default_:443>
<VirtualHost _default_:443> ServerAdmin webmaster@localhost
ServerAdmin webmaster@localhost ServerName <%= @params[:server_name] %>
ServerName <%= @params[:server_name] %> ServerAlias <%= @params[:server_aliases] %>
ServerAlias <%= @params[:server_aliases] %>
DocumentRoot <%= @params[:docroot] %>
DocumentRoot <%= @params[:docroot] %> <Directory <%= @params[:docroot] %>>
<Directory <%= @params[:docroot] %>> Options FollowSymLinks MultiViews
Options FollowSymLinks MultiViews AllowOverride All
AllowOverride All Require all granted
Require all granted </Directory>
</Directory>
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn, # error, crit, alert, emerg.
# error, crit, alert, emerg. # It is also possible to configure the loglevel for particular
# It is also possible to configure the loglevel for particular # modules, e.g.
# modules, e.g. #LogLevel info ssl:warn
#LogLevel info ssl:warn
ErrorLog /var/log/apache2/ssl-error.log
ErrorLog /var/log/apache2/ssl-error.log CustomLog /var/log/apache2/ssl-access.log combined
CustomLog /var/log/apache2/ssl-access.log combined
# For most configuration files from conf-available/, which are
# For most configuration files from conf-available/, which are # enabled or disabled at a global level, it is possible to
# enabled or disabled at a global level, it is possible to # include a line for only one particular virtual host. For example the
# include a line for only one particular virtual host. For example the # following line enables the CGI configuration for this host only
# following line enables the CGI configuration for this host only # after it has been globally disabled with "a2disconf".
# after it has been globally disabled with "a2disconf". #Include conf-available/serve-cgi-bin.conf
#Include conf-available/serve-cgi-bin.conf
# SSL Engine Switch:
# SSL Engine Switch: # Enable/Disable SSL for this virtual host.
# Enable/Disable SSL for this virtual host. SSLEngine on
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# A self-signed (snakeoil) certificate can be created by installing # the ssl-cert package. See
# the ssl-cert package. See # /usr/share/doc/apache2/README.Debian.gz for more info.
# /usr/share/doc/apache2/README.Debian.gz for more info. # If both key and certificate are stored in the same file, only the
# If both key and certificate are stored in the same file, only the # SSLCertificateFile directive is needed.
# SSLCertificateFile directive is needed. #SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
#SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem #SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
#SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key SSLCertificateFile /etc/apache2/ssl/sslKey.crt
SSLCertificateFile /etc/apache2/ssl/sslKey.crt SSLCertificateKeyFile /etc/apache2/ssl/sslKey.key
SSLCertificateKeyFile /etc/apache2/ssl/sslKey.key
# HSTS (mod_headers is required) (15768000 seconds = 6 months)
# Server Certificate Chain: Header always set Strict-Transport-Security "max-age=15768000"
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the # Server Certificate Chain:
# certificate chain for the server certificate. Alternatively # Point SSLCertificateChainFile at a file containing the
# the referenced file can be the same as SSLCertificateFile # concatenation of PEM encoded CA certificates which form the
# when the CA certificates are directly appended to the server # certificate chain for the server certificate. Alternatively
# certificate for convinience. # the referenced file can be the same as SSLCertificateFile
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt # when the CA certificates are directly appended to the server
# certificate for convinience.
# Certificate Authority (CA): #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one # Certificate Authority (CA):
# huge file containing all of them (file must be PEM encoded) # Set the CA certificate verification path where to find CA
# Note: Inside SSLCACertificatePath you need hash symlinks # certificates for client authentication or alternatively one
# to point to the certificate files. Use the provided # huge file containing all of them (file must be PEM encoded)
# Makefile to update the hash symlinks after changes. # Note: Inside SSLCACertificatePath you need hash symlinks
#SSLCACertificatePath /etc/ssl/certs/ # to point to the certificate files. Use the provided
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt # Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
# Certificate Revocation Lists (CRL): #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all # Certificate Revocation Lists (CRL):
# of them (file must be PEM encoded) # Set the CA revocation path where to find CA CRLs for client
# Note: Inside SSLCARevocationPath you need hash symlinks # authentication or alternatively one huge file containing all
# to point to the certificate files. Use the provided # of them (file must be PEM encoded)
# Makefile to update the hash symlinks after changes. # Note: Inside SSLCARevocationPath you need hash symlinks
#SSLCARevocationPath /etc/apache2/ssl.crl/ # to point to the certificate files. Use the provided
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl # Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
# Client Authentication (Type): #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a # Client Authentication (Type):
# number which specifies how deeply to verify the certificate # Client certificate verification type and depth. Types are
# issuer chain before deciding the certificate is not valid. # none, optional, require and optional_no_ca. Depth is a
#SSLVerifyClient require # number which specifies how deeply to verify the certificate
#SSLVerifyDepth 10 # issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
# SSL Engine Options: #SSLVerifyDepth 10
# Set various options for the SSL engine.
# o FakeBasicAuth: # SSL Engine Options:
# Translate the client X.509 into a Basic Authorisation. This means that # Set various options for the SSL engine.
# the standard Auth/DBMAuth methods can be used for access control. The # o FakeBasicAuth:
# user name is the `one line' version of the client's X.509 certificate. # Translate the client X.509 into a Basic Authorisation. This means that
# Note that no password is obtained from the user. Every entry in the user # the standard Auth/DBMAuth methods can be used for access control. The
# file needs this password: `xxj31ZMTZzkVA'. # user name is the `one line' version of the client's X.509 certificate.
# o ExportCertData: # Note that no password is obtained from the user. Every entry in the user
# This exports two additional environment variables: SSL_CLIENT_CERT and # file needs this password: `xxj31ZMTZzkVA'.
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the # o ExportCertData:
# server (always existing) and the client (only existing when client # This exports two additional environment variables: SSL_CLIENT_CERT and
# authentication is used). This can be used to import the certificates # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# into CGI scripts. # server (always existing) and the client (only existing when client
# o StdEnvVars: # authentication is used). This can be used to import the certificates
# This exports the standard SSL/TLS related `SSL_*' environment variables. # into CGI scripts.
# Per default this exportation is switched off for performance reasons, # o StdEnvVars:
# because the extraction step is an expensive operation and is usually # This exports the standard SSL/TLS related `SSL_*' environment variables.
# useless for serving static content. So one usually enables the # Per default this exportation is switched off for performance reasons,
# exportation for CGI and SSI requests only. # because the extraction step is an expensive operation and is usually
# o OptRenegotiate: # useless for serving static content. So one usually enables the
# This enables optimized SSL connection renegotiation handling when SSL # exportation for CGI and SSI requests only.
# directives are used in per-directory context. # o OptRenegotiate:
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire # This enables optimized SSL connection renegotiation handling when SSL
<FilesMatch "\.(cgi|shtml|phtml|php)$"> # directives are used in per-directory context.
SSLOptions +StdEnvVars #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
</FilesMatch> <FilesMatch "\.(cgi|shtml|phtml|php)$">
<Directory /usr/lib/cgi-bin> SSLOptions +StdEnvVars
SSLOptions +StdEnvVars </FilesMatch>
</Directory> <Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
# SSL Protocol Adjustments: </Directory>
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for # SSL Protocol Adjustments:
# the close notify alert from client. When you need a different shutdown # The safe and default but still SSL/TLS standard compliant shutdown
# approach you can use one of the following variables: # approach is that mod_ssl sends the close notify alert but doesn't wait for
# o ssl-unclean-shutdown: # the close notify alert from client. When you need a different shutdown
# This forces an unclean shutdown when the connection is closed, i.e. no # approach you can use one of the following variables:
# SSL close notify alert is send or allowed to received. This violates # o ssl-unclean-shutdown:
# the SSL/TLS standard but is needed for some brain-dead browsers. Use # This forces an unclean shutdown when the connection is closed, i.e. no
# this when you receive I/O errors because of the standard approach where # SSL close notify alert is send or allowed to received. This violates
# mod_ssl sends the close notify alert. # the SSL/TLS standard but is needed for some brain-dead browsers. Use
# o ssl-accurate-shutdown: # this when you receive I/O errors because of the standard approach where
# This forces an accurate shutdown when the connection is closed, i.e. a # mod_ssl sends the close notify alert.
# SSL close notify alert is send and mod_ssl waits for the close notify # o ssl-accurate-shutdown:
# alert of the client. This is 100% SSL/TLS standard compliant, but in # This forces an accurate shutdown when the connection is closed, i.e. a
# practice often causes hanging connections with brain-dead browsers. Use # SSL close notify alert is send and mod_ssl waits for the close notify
# this only for browsers where you know that their SSL implementation # alert of the client. This is 100% SSL/TLS standard compliant, but in
# works correctly. # practice often causes hanging connections with brain-dead browsers. Use
# Notice: Most problems of broken clients are also related to the HTTP # this only for browsers where you know that their SSL implementation
# keep-alive facility, so you usually additionally want to disable # works correctly.
# keep-alive for those clients, too. Use variable "nokeepalive" for this. # Notice: Most problems of broken clients are also related to the HTTP
# Similarly, one has to force some clients to use HTTP/1.0 to workaround # keep-alive facility, so you usually additionally want to disable
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and # keep-alive for those clients, too. Use variable "nokeepalive" for this.
# "force-response-1.0" for this. # Similarly, one has to force some clients to use HTTP/1.0 to workaround
BrowserMatch "MSIE [2-6]" \ # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
nokeepalive ssl-unclean-shutdown \ # "force-response-1.0" for this.
downgrade-1.0 force-response-1.0 BrowserMatch "MSIE [2-6]" \
# MSIE 7 and newer should be able to use keepalive nokeepalive ssl-unclean-shutdown \
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
## Secure SSL config. See: https://bettercrypto.org/static/applied-crypto-hardening.pdf BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On # https://mozilla.github.io/server-side-tls/ssl-config-generator/
SSLCompression off SSLProtocol all -SSLv3
# Add six earth month HSTS header for all users... SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
# ATTENTION! Needs header module enabled. SSLHonorCipherOrder on
Header always set Strict-Transport-Security "max-age=15768000" SSLCompression off
# If you want to protect all subdomains, use the following header
# ALL subdomains HAVE TO support HTTPS if you use this! # OCSP Stapling, only in httpd 2.3.3 and later
# Strict-Transport-Security: "max-age=15768000 ; includeSubDomains" SSLUseStapling on
SSLCipherSuite 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:$ SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
</VirtualHost> SSLStaplingCache shmcb:/var/run/ocsp(128000)
</IfModule>
<VirtualHost *:80> <VirtualHost *:80>
ServerAdmin webmaster@localhost ServerAdmin webmaster@localhost
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment