From de4c51116033c0beeb38128621c5ef8bbf48bf84 Mon Sep 17 00:00:00 2001 From: Thomas Merkel Date: Mon, 4 Aug 2014 18:44:35 +0200 Subject: [PATCH] enable ssl --- .../local/etc/httpd/conf.d/00-modules.conf | 2 +- copy/opt/local/etc/httpd/conf.d/08-ssl.conf | 84 +++++++++++++++++++ 2 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 copy/opt/local/etc/httpd/conf.d/08-ssl.conf diff --git a/copy/opt/local/etc/httpd/conf.d/00-modules.conf b/copy/opt/local/etc/httpd/conf.d/00-modules.conf index af9086d..83fdd59 100644 --- a/copy/opt/local/etc/httpd/conf.d/00-modules.conf +++ b/copy/opt/local/etc/httpd/conf.d/00-modules.conf @@ -80,7 +80,7 @@ LoadModule proxy_fcgi_module lib/httpd/mod_proxy_fcgi.so #LoadModule session_dbd_module lib/httpd/mod_session_dbd.so #LoadModule slotmem_shm_module lib/httpd/mod_slotmem_shm.so #LoadModule slotmem_plain_module lib/httpd/mod_slotmem_plain.so -#LoadModule ssl_module lib/httpd/mod_ssl.so +LoadModule ssl_module lib/httpd/mod_ssl.so #LoadModule dialup_module lib/httpd/mod_dialup.so #LoadModule lbmethod_byrequests_module lib/httpd/mod_lbmethod_byrequests.so #LoadModule lbmethod_bytraffic_module lib/httpd/mod_lbmethod_bytraffic.so diff --git a/copy/opt/local/etc/httpd/conf.d/08-ssl.conf b/copy/opt/local/etc/httpd/conf.d/08-ssl.conf new file mode 100644 index 0000000..e7b2879 --- /dev/null +++ b/copy/opt/local/etc/httpd/conf.d/08-ssl.conf @@ -0,0 +1,84 @@ + + # Pseudo Random Number Generator (PRNG): + # Configure one or more sources to seed the PRNG of the SSL library. + # The seed data should be of good random quality. + # WARNING! On some platforms /dev/random blocks if not enough entropy + # is available. This means you then cannot use the /dev/random device + # because it would lead to very long connection times (as long as + # it requires to make more entropy available). But usually those + # platforms additionally provide a /dev/urandom device which doesn't + # block. So, if available, use this one instead. Read the mod_ssl User + # Manual for more details. + SSLRandomSeed startup builtin + SSLRandomSeed startup file:/dev/urandom 512 + SSLRandomSeed connect builtin + SSLRandomSeed connect file:/dev/urandom 512 + + ## + ## SSL Global Context + ## + ## All SSL configuration in this context applies both to + ## the main server and all SSL-enabled virtual hosts. + ## + + # + # Some MIME-types for downloading Certificates and CRLs + # + AddType application/x-x509-ca-cert .crt + AddType application/x-pkcs7-crl .crl + + # Pass Phrase Dialog: + # Configure the pass phrase gathering process. + # The filtering dialog program (`builtin' is a internal + # terminal dialog) has to provide the pass phrase on stdout. + SSLPassPhraseDialog builtin + + # Inter-Process Session Cache: + # Configure the SSL Session Cache: First the mechanism + # to use and second the expiring timeout (in seconds). + # (The mechanism dbm has known memory leaks and should not be used). + #SSLSessionCache dbm:/var/run/ssl_scache + SSLSessionCache shmcb:/var/run/ssl_scache(512000) + SSLSessionCacheTimeout 300 + + # Semaphore: + # Configure the path to the mutual exclusion semaphore the + # SSL engine uses internally for inter-process synchronization. + # (Disabled by default, the global Mutex directive consolidates by default + # this) + #Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache + + + # SSL Cipher Suite: + # List the ciphers that the client is permitted to negotiate. See the + # ciphers(1) man page from the openssl package for list of all available + # options. + # Enable only secure ciphers: + SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 + + # Speed-optimized SSL Cipher configuration: + # If speed is your main concern (on busy HTTPS servers e.g.), + # you might want to force clients to specific, performance + # optimized ciphers. In this case, prepend those ciphers + # to the SSLCipherSuite list, and enable SSLHonorCipherOrder. + # Caveat: by giving precedence to RC4-SHA and AES128-SHA + # (as in the example below), most connections will no longer + # have perfect forward secrecy - if the server's key is + # compromised, captures of past or future traffic must be + # considered compromised, too. + #SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 + #SSLHonorCipherOrder on + + # The protocols to enable. + # Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2 + # SSL v2 is no longer supported + SSLProtocol all + + # Allow insecure renegotiation with clients which do not yet support the + # secure renegotiation protocol. Default: Off + #SSLInsecureRenegotiation on + + # Whether to forbid non-SNI clients to access name based virtual hosts. + # Default: Off + #SSLStrictSNIVHostCheck On +