[1407] | 1 | # |
---|
| 2 | # This is the Apache server configuration file providing SSL support. |
---|
| 3 | # It contains the configuration directives to instruct the server how to |
---|
| 4 | # serve pages over an https connection. For detailing information about these |
---|
| 5 | # directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html> |
---|
| 6 | # |
---|
| 7 | # Do NOT simply read the instructions in here without understanding |
---|
| 8 | # what they do. They're here only as hints or reminders. If you are unsure |
---|
| 9 | # consult the online docs. You have been warned. |
---|
| 10 | # |
---|
| 11 | |
---|
| 12 | LoadModule ssl_module modules/mod_ssl.so |
---|
| 13 | |
---|
| 14 | # |
---|
| 15 | # When we also provide SSL we have to listen to the |
---|
| 16 | # the HTTPS port in addition. |
---|
| 17 | # |
---|
| 18 | Listen 443 |
---|
| 19 | |
---|
| 20 | ## |
---|
| 21 | ## SSL Global Context |
---|
| 22 | ## |
---|
| 23 | ## All SSL configuration in this context applies both to |
---|
| 24 | ## the main server and all SSL-enabled virtual hosts. |
---|
| 25 | ## |
---|
| 26 | |
---|
| 27 | # |
---|
| 28 | # Some MIME-types for downloading Certificates and CRLs |
---|
| 29 | # |
---|
| 30 | AddType application/x-x509-ca-cert .crt |
---|
| 31 | AddType application/x-pkcs7-crl .crl |
---|
| 32 | |
---|
| 33 | # Pass Phrase Dialog: |
---|
| 34 | # Configure the pass phrase gathering process. |
---|
| 35 | # The filtering dialog program (`builtin' is a internal |
---|
| 36 | # terminal dialog) has to provide the pass phrase on stdout. |
---|
| 37 | SSLPassPhraseDialog builtin |
---|
| 38 | |
---|
| 39 | # Inter-Process Session Cache: |
---|
| 40 | # Configure the SSL Session Cache: First the mechanism |
---|
| 41 | # to use and second the expiring timeout (in seconds). |
---|
| 42 | #SSLSessionCache dc:UNIX:/var/cache/mod_ssl/distcache |
---|
| 43 | SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) |
---|
| 44 | SSLSessionCacheTimeout 300 |
---|
| 45 | |
---|
| 46 | # Semaphore: |
---|
| 47 | # Configure the path to the mutual exclusion semaphore the |
---|
| 48 | # SSL engine uses internally for inter-process synchronization. |
---|
| 49 | SSLMutex default |
---|
| 50 | |
---|
| 51 | # Pseudo Random Number Generator (PRNG): |
---|
| 52 | # Configure one or more sources to seed the PRNG of the |
---|
| 53 | # SSL library. The seed data should be of good random quality. |
---|
| 54 | # WARNING! On some platforms /dev/random blocks if not enough entropy |
---|
| 55 | # is available. This means you then cannot use the /dev/random device |
---|
| 56 | # because it would lead to very long connection times (as long as |
---|
| 57 | # it requires to make more entropy available). But usually those |
---|
| 58 | # platforms additionally provide a /dev/urandom device which doesn't |
---|
| 59 | # block. So, if available, use this one instead. Read the mod_ssl User |
---|
| 60 | # Manual for more details. |
---|
| 61 | SSLRandomSeed startup file:/dev/urandom 256 |
---|
| 62 | SSLRandomSeed connect builtin |
---|
| 63 | #SSLRandomSeed startup file:/dev/random 512 |
---|
| 64 | #SSLRandomSeed connect file:/dev/random 512 |
---|
| 65 | #SSLRandomSeed connect file:/dev/urandom 512 |
---|
| 66 | |
---|
| 67 | # |
---|
| 68 | # Use "SSLCryptoDevice" to enable any supported hardware |
---|
| 69 | # accelerators. Use "openssl engine -v" to list supported |
---|
| 70 | # engine names. NOTE: If you enable an accelerator and the |
---|
| 71 | # server does not start, consult the error logs and ensure |
---|
| 72 | # your accelerator is functioning properly. |
---|
| 73 | # |
---|
| 74 | SSLCryptoDevice builtin |
---|
| 75 | #SSLCryptoDevice ubsec |
---|
| 76 | |
---|
| 77 | ## |
---|
| 78 | ## SSL Virtual Host Context |
---|
| 79 | ## |
---|
| 80 | |
---|
| 81 | <VirtualHost _default_:443> |
---|
| 82 | DocumentRoot "/var/www/expresso" |
---|
| 83 | #ServerName www.example.com:443 |
---|
| 84 | |
---|
| 85 | # Use separate log files for the SSL virtual host; note that LogLevel |
---|
| 86 | # is not inherited from httpd.conf. |
---|
| 87 | ErrorLog logs/ssl_error_log |
---|
| 88 | TransferLog logs/ssl_access_log |
---|
| 89 | LogLevel warn |
---|
| 90 | |
---|
| 91 | # SSL Engine Switch: |
---|
| 92 | # Enable/Disable SSL for this virtual host. |
---|
| 93 | SSLEngine on |
---|
| 94 | |
---|
| 95 | # SSL Protocol support: |
---|
| 96 | # List the enable protocol levels with which clients will be able to |
---|
| 97 | # connect. Disable SSLv2 access by default: |
---|
| 98 | SSLProtocol all -SSLv2 |
---|
| 99 | |
---|
| 100 | # SSL Cipher Suite: |
---|
| 101 | # List the ciphers that the client is permitted to negotiate. |
---|
| 102 | # See the mod_ssl documentation for a complete list. |
---|
| 103 | SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW |
---|
| 104 | |
---|
| 105 | # Server Certificate: |
---|
| 106 | # Point SSLCertificateFile at a PEM encoded certificate. If |
---|
| 107 | # the certificate is encrypted, then you will be prompted for a |
---|
| 108 | # pass phrase. Note that a kill -HUP will prompt again. A new |
---|
| 109 | # certificate can be generated using the genkey(1) command. |
---|
| 110 | SSLCertificateFile /etc/pki/tls/certs/localhost.crt |
---|
| 111 | |
---|
| 112 | # Server Private Key: |
---|
| 113 | # If the key is not combined with the certificate, use this |
---|
| 114 | # directive to point at the key file. Keep in mind that if |
---|
| 115 | # you've both a RSA and a DSA private key you can configure |
---|
| 116 | # both in parallel (to also allow the use of DSA ciphers, etc.) |
---|
| 117 | SSLCertificateKeyFile /etc/pki/tls/private/localhost.key |
---|
| 118 | |
---|
| 119 | # Server Certificate Chain: |
---|
| 120 | # Point SSLCertificateChainFile at a file containing the |
---|
| 121 | # concatenation of PEM encoded CA certificates which form the |
---|
| 122 | # certificate chain for the server certificate. Alternatively |
---|
| 123 | # the referenced file can be the same as SSLCertificateFile |
---|
| 124 | # when the CA certificates are directly appended to the server |
---|
| 125 | # certificate for convinience. |
---|
| 126 | #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt |
---|
| 127 | |
---|
| 128 | # Certificate Authority (CA): |
---|
| 129 | # Set the CA certificate verification path where to find CA |
---|
| 130 | # certificates for client authentication or alternatively one |
---|
| 131 | # huge file containing all of them (file must be PEM encoded) |
---|
| 132 | #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt |
---|
| 133 | |
---|
| 134 | # Client Authentication (Type): |
---|
| 135 | # Client certificate verification type and depth. Types are |
---|
| 136 | # none, optional, require and optional_no_ca. Depth is a |
---|
| 137 | # number which specifies how deeply to verify the certificate |
---|
| 138 | # issuer chain before deciding the certificate is not valid. |
---|
| 139 | #SSLVerifyClient require |
---|
| 140 | #SSLVerifyDepth 10 |
---|
| 141 | |
---|
| 142 | # Access Control: |
---|
| 143 | # With SSLRequire you can do per-directory access control based |
---|
| 144 | # on arbitrary complex boolean expressions containing server |
---|
| 145 | # variable checks and other lookup directives. The syntax is a |
---|
| 146 | # mixture between C and Perl. See the mod_ssl documentation |
---|
| 147 | # for more details. |
---|
| 148 | #<Location /> |
---|
| 149 | #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ |
---|
| 150 | # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ |
---|
| 151 | # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ |
---|
| 152 | # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ |
---|
| 153 | # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ |
---|
| 154 | # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ |
---|
| 155 | #</Location> |
---|
| 156 | |
---|
| 157 | # SSL Engine Options: |
---|
| 158 | # Set various options for the SSL engine. |
---|
| 159 | # o FakeBasicAuth: |
---|
| 160 | # Translate the client X.509 into a Basic Authorisation. This means that |
---|
| 161 | # the standard Auth/DBMAuth methods can be used for access control. The |
---|
| 162 | # user name is the `one line' version of the client's X.509 certificate. |
---|
| 163 | # Note that no password is obtained from the user. Every entry in the user |
---|
| 164 | # file needs this password: `xxj31ZMTZzkVA'. |
---|
| 165 | # o ExportCertData: |
---|
| 166 | # This exports two additional environment variables: SSL_CLIENT_CERT and |
---|
| 167 | # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the |
---|
| 168 | # server (always existing) and the client (only existing when client |
---|
| 169 | # authentication is used). This can be used to import the certificates |
---|
| 170 | # into CGI scripts. |
---|
| 171 | # o StdEnvVars: |
---|
| 172 | # This exports the standard SSL/TLS related `SSL_*' environment variables. |
---|
| 173 | # Per default this exportation is switched off for performance reasons, |
---|
| 174 | # because the extraction step is an expensive operation and is usually |
---|
| 175 | # useless for serving static content. So one usually enables the |
---|
| 176 | # exportation for CGI and SSI requests only. |
---|
| 177 | # o StrictRequire: |
---|
| 178 | # This denies access when "SSLRequireSSL" or "SSLRequire" applied even |
---|
| 179 | # under a "Satisfy any" situation, i.e. when it applies access is denied |
---|
| 180 | # and no other module can change it. |
---|
| 181 | # o OptRenegotiate: |
---|
| 182 | # This enables optimized SSL connection renegotiation handling when SSL |
---|
| 183 | # directives are used in per-directory context. |
---|
| 184 | #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire |
---|
| 185 | <Files ~ "\.(cgi|shtml|phtml|php3?)$"> |
---|
| 186 | SSLOptions +StdEnvVars |
---|
| 187 | </Files> |
---|
| 188 | <Directory "/var/www/cgi-bin"> |
---|
| 189 | SSLOptions +StdEnvVars |
---|
| 190 | </Directory> |
---|
| 191 | |
---|
| 192 | # SSL Protocol Adjustments: |
---|
| 193 | # The safe and default but still SSL/TLS standard compliant shutdown |
---|
| 194 | # approach is that mod_ssl sends the close notify alert but doesn't wait for |
---|
| 195 | # the close notify alert from client. When you need a different shutdown |
---|
| 196 | # approach you can use one of the following variables: |
---|
| 197 | # o ssl-unclean-shutdown: |
---|
| 198 | # This forces an unclean shutdown when the connection is closed, i.e. no |
---|
| 199 | # SSL close notify alert is send or allowed to received. This violates |
---|
| 200 | # the SSL/TLS standard but is needed for some brain-dead browsers. Use |
---|
| 201 | # this when you receive I/O errors because of the standard approach where |
---|
| 202 | # mod_ssl sends the close notify alert. |
---|
| 203 | # o ssl-accurate-shutdown: |
---|
| 204 | # This forces an accurate shutdown when the connection is closed, i.e. a |
---|
| 205 | # SSL close notify alert is send and mod_ssl waits for the close notify |
---|
| 206 | # alert of the client. This is 100% SSL/TLS standard compliant, but in |
---|
| 207 | # practice often causes hanging connections with brain-dead browsers. Use |
---|
| 208 | # this only for browsers where you know that their SSL implementation |
---|
| 209 | # works correctly. |
---|
| 210 | # Notice: Most problems of broken clients are also related to the HTTP |
---|
| 211 | # keep-alive facility, so you usually additionally want to disable |
---|
| 212 | # keep-alive for those clients, too. Use variable "nokeepalive" for this. |
---|
| 213 | # Similarly, one has to force some clients to use HTTP/1.0 to workaround |
---|
| 214 | # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and |
---|
| 215 | # "force-response-1.0" for this. |
---|
| 216 | SetEnvIf User-Agent ".*MSIE.*" \ |
---|
| 217 | nokeepalive ssl-unclean-shutdown \ |
---|
| 218 | downgrade-1.0 force-response-1.0 |
---|
| 219 | |
---|
| 220 | # Per-Server Logging: |
---|
| 221 | # The home of a custom SSL log file. Use this when you want a |
---|
| 222 | # compact non-error SSL logfile on a virtual host basis. |
---|
| 223 | CustomLog logs/ssl_request_log \ |
---|
| 224 | "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" |
---|
| 225 | |
---|
| 226 | </VirtualHost> |
---|
| 227 | |
---|