source: sandbox/2.3-MailArchiver/doc-expressolivre/rhel5-centos5/arqs-conf-rhel5/etc/httpd/conf.d/ssl.conf @ 6779

Revision 6779, 9.4 KB checked in by rafaelraymundo, 12 years ago (diff)

Ticket #2946 - Liberado Expresso(branch 2.3) integrado ao MailArchiver?.

Line 
1#
2# This is the Apache server configuration file providing SSL support.
3# It contains the configuration directives to instruct the server how to
4# serve pages over an https connection. For detailing information about these
5# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
6#
7# Do NOT simply read the instructions in here without understanding
8# what they do.  They're here only as hints or reminders.  If you are unsure
9# consult the online docs. You have been warned. 
10#
11
12LoadModule ssl_module modules/mod_ssl.so
13
14#
15# When we also provide SSL we have to listen to the
16# the HTTPS port in addition.
17#
18Listen 443
19
20##
21##  SSL Global Context
22##
23##  All SSL configuration in this context applies both to
24##  the main server and all SSL-enabled virtual hosts.
25##
26
27#
28#   Some MIME-types for downloading Certificates and CRLs
29#
30AddType application/x-x509-ca-cert .crt
31AddType application/x-pkcs7-crl    .crl
32
33#   Pass Phrase Dialog:
34#   Configure the pass phrase gathering process.
35#   The filtering dialog program (`builtin' is a internal
36#   terminal dialog) has to provide the pass phrase on stdout.
37SSLPassPhraseDialog  builtin
38
39#   Inter-Process Session Cache:
40#   Configure the SSL Session Cache: First the mechanism
41#   to use and second the expiring timeout (in seconds).
42#SSLSessionCache        dc:UNIX:/var/cache/mod_ssl/distcache
43SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
44SSLSessionCacheTimeout  300
45
46#   Semaphore:
47#   Configure the path to the mutual exclusion semaphore the
48#   SSL engine uses internally for inter-process synchronization.
49SSLMutex default
50
51#   Pseudo Random Number Generator (PRNG):
52#   Configure one or more sources to seed the PRNG of the
53#   SSL library. The seed data should be of good random quality.
54#   WARNING! On some platforms /dev/random blocks if not enough entropy
55#   is available. This means you then cannot use the /dev/random device
56#   because it would lead to very long connection times (as long as
57#   it requires to make more entropy available). But usually those
58#   platforms additionally provide a /dev/urandom device which doesn't
59#   block. So, if available, use this one instead. Read the mod_ssl User
60#   Manual for more details.
61SSLRandomSeed startup file:/dev/urandom  256
62SSLRandomSeed connect builtin
63#SSLRandomSeed startup file:/dev/random  512
64#SSLRandomSeed connect file:/dev/random  512
65#SSLRandomSeed connect file:/dev/urandom 512
66
67#
68# Use "SSLCryptoDevice" to enable any supported hardware
69# accelerators. Use "openssl engine -v" to list supported
70# engine names.  NOTE: If you enable an accelerator and the
71# server does not start, consult the error logs and ensure
72# your accelerator is functioning properly.
73#
74SSLCryptoDevice builtin
75#SSLCryptoDevice ubsec
76
77##
78## SSL Virtual Host Context
79##
80
81<VirtualHost _default_:443>
82DocumentRoot "/var/www/expresso"
83#ServerName www.example.com:443
84
85# Use separate log files for the SSL virtual host; note that LogLevel
86# is not inherited from httpd.conf.
87ErrorLog logs/ssl_error_log
88TransferLog logs/ssl_access_log
89LogLevel warn
90
91#   SSL Engine Switch:
92#   Enable/Disable SSL for this virtual host.
93SSLEngine on
94
95#   SSL Protocol support:
96# List the enable protocol levels with which clients will be able to
97# connect.  Disable SSLv2 access by default:
98SSLProtocol all -SSLv2
99
100#   SSL Cipher Suite:
101# List the ciphers that the client is permitted to negotiate.
102# See the mod_ssl documentation for a complete list.
103SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
104
105#   Server Certificate:
106# Point SSLCertificateFile at a PEM encoded certificate.  If
107# the certificate is encrypted, then you will be prompted for a
108# pass phrase.  Note that a kill -HUP will prompt again.  A new
109# certificate can be generated using the genkey(1) command.
110SSLCertificateFile /etc/pki/tls/certs/localhost.crt
111
112#   Server Private Key:
113#   If the key is not combined with the certificate, use this
114#   directive to point at the key file.  Keep in mind that if
115#   you've both a RSA and a DSA private key you can configure
116#   both in parallel (to also allow the use of DSA ciphers, etc.)
117SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
118
119#   Server Certificate Chain:
120#   Point SSLCertificateChainFile at a file containing the
121#   concatenation of PEM encoded CA certificates which form the
122#   certificate chain for the server certificate. Alternatively
123#   the referenced file can be the same as SSLCertificateFile
124#   when the CA certificates are directly appended to the server
125#   certificate for convinience.
126#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
127
128#   Certificate Authority (CA):
129#   Set the CA certificate verification path where to find CA
130#   certificates for client authentication or alternatively one
131#   huge file containing all of them (file must be PEM encoded)
132#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
133
134#   Client Authentication (Type):
135#   Client certificate verification type and depth.  Types are
136#   none, optional, require and optional_no_ca.  Depth is a
137#   number which specifies how deeply to verify the certificate
138#   issuer chain before deciding the certificate is not valid.
139#SSLVerifyClient require
140#SSLVerifyDepth  10
141
142#   Access Control:
143#   With SSLRequire you can do per-directory access control based
144#   on arbitrary complex boolean expressions containing server
145#   variable checks and other lookup directives.  The syntax is a
146#   mixture between C and Perl.  See the mod_ssl documentation
147#   for more details.
148#<Location />
149#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
150#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
151#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
152#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
153#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
154#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
155#</Location>
156
157#   SSL Engine Options:
158#   Set various options for the SSL engine.
159#   o FakeBasicAuth:
160#     Translate the client X.509 into a Basic Authorisation.  This means that
161#     the standard Auth/DBMAuth methods can be used for access control.  The
162#     user name is the `one line' version of the client's X.509 certificate.
163#     Note that no password is obtained from the user. Every entry in the user
164#     file needs this password: `xxj31ZMTZzkVA'.
165#   o ExportCertData:
166#     This exports two additional environment variables: SSL_CLIENT_CERT and
167#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
168#     server (always existing) and the client (only existing when client
169#     authentication is used). This can be used to import the certificates
170#     into CGI scripts.
171#   o StdEnvVars:
172#     This exports the standard SSL/TLS related `SSL_*' environment variables.
173#     Per default this exportation is switched off for performance reasons,
174#     because the extraction step is an expensive operation and is usually
175#     useless for serving static content. So one usually enables the
176#     exportation for CGI and SSI requests only.
177#   o StrictRequire:
178#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
179#     under a "Satisfy any" situation, i.e. when it applies access is denied
180#     and no other module can change it.
181#   o OptRenegotiate:
182#     This enables optimized SSL connection renegotiation handling when SSL
183#     directives are used in per-directory context.
184#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
185<Files ~ "\.(cgi|shtml|phtml|php3?)$">
186    SSLOptions +StdEnvVars
187</Files>
188<Directory "/var/www/cgi-bin">
189    SSLOptions +StdEnvVars
190</Directory>
191
192#   SSL Protocol Adjustments:
193#   The safe and default but still SSL/TLS standard compliant shutdown
194#   approach is that mod_ssl sends the close notify alert but doesn't wait for
195#   the close notify alert from client. When you need a different shutdown
196#   approach you can use one of the following variables:
197#   o ssl-unclean-shutdown:
198#     This forces an unclean shutdown when the connection is closed, i.e. no
199#     SSL close notify alert is send or allowed to received.  This violates
200#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
201#     this when you receive I/O errors because of the standard approach where
202#     mod_ssl sends the close notify alert.
203#   o ssl-accurate-shutdown:
204#     This forces an accurate shutdown when the connection is closed, i.e. a
205#     SSL close notify alert is send and mod_ssl waits for the close notify
206#     alert of the client. This is 100% SSL/TLS standard compliant, but in
207#     practice often causes hanging connections with brain-dead browsers. Use
208#     this only for browsers where you know that their SSL implementation
209#     works correctly.
210#   Notice: Most problems of broken clients are also related to the HTTP
211#   keep-alive facility, so you usually additionally want to disable
212#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
213#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
214#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
215#   "force-response-1.0" for this.
216SetEnvIf User-Agent ".*MSIE.*" \
217         nokeepalive ssl-unclean-shutdown \
218         downgrade-1.0 force-response-1.0
219
220#   Per-Server Logging:
221#   The home of a custom SSL log file. Use this when you want a
222#   compact non-error SSL logfile on a virtual host basis.
223CustomLog logs/ssl_request_log \
224          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
225
226</VirtualHost>                                 
227
Note: See TracBrowser for help on using the repository browser.