1 | # |
---|
2 | # This is the Apache server configuration file providing SSL support. |
---|
3 | # It contains the configuration directives to instruct the server how to |
---|
4 | # serve pages over an https connection. For detailing information about these |
---|
5 | # directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html> |
---|
6 | # |
---|
7 | # Do NOT simply read the instructions in here without understanding |
---|
8 | # what they do. They're here only as hints or reminders. If you are unsure |
---|
9 | # consult the online docs. You have been warned. |
---|
10 | # |
---|
11 | |
---|
12 | LoadModule ssl_module modules/mod_ssl.so |
---|
13 | |
---|
14 | # |
---|
15 | # When we also provide SSL we have to listen to the |
---|
16 | # the HTTPS port in addition. |
---|
17 | # |
---|
18 | Listen 443 |
---|
19 | |
---|
20 | ## |
---|
21 | ## SSL Global Context |
---|
22 | ## |
---|
23 | ## All SSL configuration in this context applies both to |
---|
24 | ## the main server and all SSL-enabled virtual hosts. |
---|
25 | ## |
---|
26 | |
---|
27 | # |
---|
28 | # Some MIME-types for downloading Certificates and CRLs |
---|
29 | # |
---|
30 | AddType application/x-x509-ca-cert .crt |
---|
31 | AddType application/x-pkcs7-crl .crl |
---|
32 | |
---|
33 | # Pass Phrase Dialog: |
---|
34 | # Configure the pass phrase gathering process. |
---|
35 | # The filtering dialog program (`builtin' is a internal |
---|
36 | # terminal dialog) has to provide the pass phrase on stdout. |
---|
37 | SSLPassPhraseDialog builtin |
---|
38 | |
---|
39 | # Inter-Process Session Cache: |
---|
40 | # Configure the SSL Session Cache: First the mechanism |
---|
41 | # to use and second the expiring timeout (in seconds). |
---|
42 | #SSLSessionCache dc:UNIX:/var/cache/mod_ssl/distcache |
---|
43 | SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) |
---|
44 | SSLSessionCacheTimeout 300 |
---|
45 | |
---|
46 | # Semaphore: |
---|
47 | # Configure the path to the mutual exclusion semaphore the |
---|
48 | # SSL engine uses internally for inter-process synchronization. |
---|
49 | SSLMutex default |
---|
50 | |
---|
51 | # Pseudo Random Number Generator (PRNG): |
---|
52 | # Configure one or more sources to seed the PRNG of the |
---|
53 | # SSL library. The seed data should be of good random quality. |
---|
54 | # WARNING! On some platforms /dev/random blocks if not enough entropy |
---|
55 | # is available. This means you then cannot use the /dev/random device |
---|
56 | # because it would lead to very long connection times (as long as |
---|
57 | # it requires to make more entropy available). But usually those |
---|
58 | # platforms additionally provide a /dev/urandom device which doesn't |
---|
59 | # block. So, if available, use this one instead. Read the mod_ssl User |
---|
60 | # Manual for more details. |
---|
61 | SSLRandomSeed startup file:/dev/urandom 256 |
---|
62 | SSLRandomSeed connect builtin |
---|
63 | #SSLRandomSeed startup file:/dev/random 512 |
---|
64 | #SSLRandomSeed connect file:/dev/random 512 |
---|
65 | #SSLRandomSeed connect file:/dev/urandom 512 |
---|
66 | |
---|
67 | # |
---|
68 | # Use "SSLCryptoDevice" to enable any supported hardware |
---|
69 | # accelerators. Use "openssl engine -v" to list supported |
---|
70 | # engine names. NOTE: If you enable an accelerator and the |
---|
71 | # server does not start, consult the error logs and ensure |
---|
72 | # your accelerator is functioning properly. |
---|
73 | # |
---|
74 | SSLCryptoDevice builtin |
---|
75 | #SSLCryptoDevice ubsec |
---|
76 | |
---|
77 | ## |
---|
78 | ## SSL Virtual Host Context |
---|
79 | ## |
---|
80 | |
---|
81 | <VirtualHost _default_:443> |
---|
82 | DocumentRoot "/var/www/expresso" |
---|
83 | #ServerName www.example.com:443 |
---|
84 | |
---|
85 | # Use separate log files for the SSL virtual host; note that LogLevel |
---|
86 | # is not inherited from httpd.conf. |
---|
87 | ErrorLog logs/ssl_error_log |
---|
88 | TransferLog logs/ssl_access_log |
---|
89 | LogLevel warn |
---|
90 | |
---|
91 | # SSL Engine Switch: |
---|
92 | # Enable/Disable SSL for this virtual host. |
---|
93 | SSLEngine on |
---|
94 | |
---|
95 | # SSL Protocol support: |
---|
96 | # List the enable protocol levels with which clients will be able to |
---|
97 | # connect. Disable SSLv2 access by default: |
---|
98 | SSLProtocol all -SSLv2 |
---|
99 | |
---|
100 | # SSL Cipher Suite: |
---|
101 | # List the ciphers that the client is permitted to negotiate. |
---|
102 | # See the mod_ssl documentation for a complete list. |
---|
103 | SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW |
---|
104 | |
---|
105 | # Server Certificate: |
---|
106 | # Point SSLCertificateFile at a PEM encoded certificate. If |
---|
107 | # the certificate is encrypted, then you will be prompted for a |
---|
108 | # pass phrase. Note that a kill -HUP will prompt again. A new |
---|
109 | # certificate can be generated using the genkey(1) command. |
---|
110 | SSLCertificateFile /etc/pki/tls/certs/localhost.crt |
---|
111 | |
---|
112 | # Server Private Key: |
---|
113 | # If the key is not combined with the certificate, use this |
---|
114 | # directive to point at the key file. Keep in mind that if |
---|
115 | # you've both a RSA and a DSA private key you can configure |
---|
116 | # both in parallel (to also allow the use of DSA ciphers, etc.) |
---|
117 | SSLCertificateKeyFile /etc/pki/tls/private/localhost.key |
---|
118 | |
---|
119 | # Server Certificate Chain: |
---|
120 | # Point SSLCertificateChainFile at a file containing the |
---|
121 | # concatenation of PEM encoded CA certificates which form the |
---|
122 | # certificate chain for the server certificate. Alternatively |
---|
123 | # the referenced file can be the same as SSLCertificateFile |
---|
124 | # when the CA certificates are directly appended to the server |
---|
125 | # certificate for convinience. |
---|
126 | #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt |
---|
127 | |
---|
128 | # Certificate Authority (CA): |
---|
129 | # Set the CA certificate verification path where to find CA |
---|
130 | # certificates for client authentication or alternatively one |
---|
131 | # huge file containing all of them (file must be PEM encoded) |
---|
132 | #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt |
---|
133 | |
---|
134 | # Client Authentication (Type): |
---|
135 | # Client certificate verification type and depth. Types are |
---|
136 | # none, optional, require and optional_no_ca. Depth is a |
---|
137 | # number which specifies how deeply to verify the certificate |
---|
138 | # issuer chain before deciding the certificate is not valid. |
---|
139 | #SSLVerifyClient require |
---|
140 | #SSLVerifyDepth 10 |
---|
141 | |
---|
142 | # Access Control: |
---|
143 | # With SSLRequire you can do per-directory access control based |
---|
144 | # on arbitrary complex boolean expressions containing server |
---|
145 | # variable checks and other lookup directives. The syntax is a |
---|
146 | # mixture between C and Perl. See the mod_ssl documentation |
---|
147 | # for more details. |
---|
148 | #<Location /> |
---|
149 | #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ |
---|
150 | # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ |
---|
151 | # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ |
---|
152 | # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ |
---|
153 | # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ |
---|
154 | # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ |
---|
155 | #</Location> |
---|
156 | |
---|
157 | # SSL Engine Options: |
---|
158 | # Set various options for the SSL engine. |
---|
159 | # o FakeBasicAuth: |
---|
160 | # Translate the client X.509 into a Basic Authorisation. This means that |
---|
161 | # the standard Auth/DBMAuth methods can be used for access control. The |
---|
162 | # user name is the `one line' version of the client's X.509 certificate. |
---|
163 | # Note that no password is obtained from the user. Every entry in the user |
---|
164 | # file needs this password: `xxj31ZMTZzkVA'. |
---|
165 | # o ExportCertData: |
---|
166 | # This exports two additional environment variables: SSL_CLIENT_CERT and |
---|
167 | # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the |
---|
168 | # server (always existing) and the client (only existing when client |
---|
169 | # authentication is used). This can be used to import the certificates |
---|
170 | # into CGI scripts. |
---|
171 | # o StdEnvVars: |
---|
172 | # This exports the standard SSL/TLS related `SSL_*' environment variables. |
---|
173 | # Per default this exportation is switched off for performance reasons, |
---|
174 | # because the extraction step is an expensive operation and is usually |
---|
175 | # useless for serving static content. So one usually enables the |
---|
176 | # exportation for CGI and SSI requests only. |
---|
177 | # o StrictRequire: |
---|
178 | # This denies access when "SSLRequireSSL" or "SSLRequire" applied even |
---|
179 | # under a "Satisfy any" situation, i.e. when it applies access is denied |
---|
180 | # and no other module can change it. |
---|
181 | # o OptRenegotiate: |
---|
182 | # This enables optimized SSL connection renegotiation handling when SSL |
---|
183 | # directives are used in per-directory context. |
---|
184 | #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire |
---|
185 | <Files ~ "\.(cgi|shtml|phtml|php3?)$"> |
---|
186 | SSLOptions +StdEnvVars |
---|
187 | </Files> |
---|
188 | <Directory "/var/www/cgi-bin"> |
---|
189 | SSLOptions +StdEnvVars |
---|
190 | </Directory> |
---|
191 | |
---|
192 | # SSL Protocol Adjustments: |
---|
193 | # The safe and default but still SSL/TLS standard compliant shutdown |
---|
194 | # approach is that mod_ssl sends the close notify alert but doesn't wait for |
---|
195 | # the close notify alert from client. When you need a different shutdown |
---|
196 | # approach you can use one of the following variables: |
---|
197 | # o ssl-unclean-shutdown: |
---|
198 | # This forces an unclean shutdown when the connection is closed, i.e. no |
---|
199 | # SSL close notify alert is send or allowed to received. This violates |
---|
200 | # the SSL/TLS standard but is needed for some brain-dead browsers. Use |
---|
201 | # this when you receive I/O errors because of the standard approach where |
---|
202 | # mod_ssl sends the close notify alert. |
---|
203 | # o ssl-accurate-shutdown: |
---|
204 | # This forces an accurate shutdown when the connection is closed, i.e. a |
---|
205 | # SSL close notify alert is send and mod_ssl waits for the close notify |
---|
206 | # alert of the client. This is 100% SSL/TLS standard compliant, but in |
---|
207 | # practice often causes hanging connections with brain-dead browsers. Use |
---|
208 | # this only for browsers where you know that their SSL implementation |
---|
209 | # works correctly. |
---|
210 | # Notice: Most problems of broken clients are also related to the HTTP |
---|
211 | # keep-alive facility, so you usually additionally want to disable |
---|
212 | # keep-alive for those clients, too. Use variable "nokeepalive" for this. |
---|
213 | # Similarly, one has to force some clients to use HTTP/1.0 to workaround |
---|
214 | # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and |
---|
215 | # "force-response-1.0" for this. |
---|
216 | SetEnvIf User-Agent ".*MSIE.*" \ |
---|
217 | nokeepalive ssl-unclean-shutdown \ |
---|
218 | downgrade-1.0 force-response-1.0 |
---|
219 | |
---|
220 | # Per-Server Logging: |
---|
221 | # The home of a custom SSL log file. Use this when you want a |
---|
222 | # compact non-error SSL logfile on a virtual host basis. |
---|
223 | CustomLog logs/ssl_request_log \ |
---|
224 | "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" |
---|
225 | |
---|
226 | </VirtualHost> |
---|
227 | |
---|