source: main/adopters/nm/trunk/src/main/serverconfigs/dmzr2nmibis001/apache_httpd_reverse_proxy/extra/httpd-ssl.conf @ 24586

Last change on this file since 24586 was 24586, checked in by Paul Leo, 6 months ago

Adding apache httpd reverse proxy config files, including Let's Encrypt configuration
Currently using Let's Encrypt staging, not production, one day renewal for testing
Only using port 443 for cert renewal for now.
nmtracking is password protected

File size: 14.6 KB
RevLine 
[24586]1#
2# This is the Apache server configuration file providing SSL support.
3# It contains the configuration directives to instruct the server how to
4# serve pages over an https connection. For detailed information about these
5# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
6#
7# Do NOT simply read the instructions in here without understanding
8# what they do.  They're here only as hints or reminders.  If you are unsure
9# consult the online docs. You have been warned. 
10#
11# Required modules: mod_log_config, mod_setenvif, mod_ssl,
12#          socache_shmcb_module (for default value of SSLSessionCache)
13
14#
15# Pseudo Random Number Generator (PRNG):
16# Configure one or more sources to seed the PRNG of the SSL library.
17# The seed data should be of good random quality.
18# WARNING! On some platforms /dev/random blocks if not enough entropy
19# is available. This means you then cannot use the /dev/random device
20# because it would lead to very long connection times (as long as
21# it requires to make more entropy available). But usually those
22# platforms additionally provide a /dev/urandom device which doesn't
23# block. So, if available, use this one instead. Read the mod_ssl User
24# Manual for more details.
25#
26#SSLRandomSeed startup file:/dev/random  512
27#SSLRandomSeed startup file:/dev/urandom 512
28#SSLRandomSeed connect file:/dev/random  512
29#SSLRandomSeed connect file:/dev/urandom 512
30
31
32#
33# When we also provide SSL we have to listen to the
34# standard HTTP port (see above) and to the HTTPS port
35#
36Listen 443
37
38##
39##  SSL Global Context
40##
41##  All SSL configuration in this context applies both to
42##  the main server and all SSL-enabled virtual hosts.
43##
44
45#   SSL Cipher Suite:
46#   List the ciphers that the client is permitted to negotiate,
47#   and that httpd will negotiate as the client of a proxied server.
48#   See the OpenSSL documentation for a complete list of ciphers, and
49#   ensure these follow appropriate best practices for this deployment.
50#   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
51#   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
52####SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
53####SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
54
55###### these are various attempts to remove/not permit weak ciphters #######
56#### WHAT WAS ON Maryland Reverse Proxy
57#### SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
58#### SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
59#### Suggested by Apache SSL/TLS Strong Encryption How-To
60#### SSLCipherSuite HIGH:!aNULL:!MD5
61#### SSLProxyCipherSuite HIGH:!aNULL:!MD5
62#### from https://www.leaderssl.com/news/471-how-to-disable-outdated-versions-of-ssl-tls-in-apache
63#### SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
64#### SSLProxyCipherSuite HIGH:!aNULL:!MD5:!3DES
65#### This From last entry https://serverfault.com/questions/848177/how-can-i-disable-tls-1-0-and-1-1-in-apache
66#####SSLCipherSuite HIGH:!kRSA:!ADH:!eNULL:!LOW:!EXP:!MD5:!3DES
67#####SSLProxyCipherSuite HIGH:!kRSA:!ADH:!eNULL:!LOW:!EXP:!MD5:!3DES
68SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
69
70
71
72
73#  By the end of 2016, only TLSv1.2 ciphers should remain in use.
74#  Older ciphers should be disallowed as soon as possible, while the
75#  kRSA ciphers do not offer forward secrecy.  These changes inhibit
76#  older clients (such as IE6 SP2 or IE8 on Windows XP, or other legacy
77#  non-browser tooling) from successfully connecting. 
78#
79#  To restrict mod_ssl to use only TLSv1.2 ciphers, and disable
80#  those protocols which do not support forward secrecy, replace
81#  the SSLCipherSuite and SSLProxyCipherSuite directives above with
82#  the following two directives, as soon as practical.
83# SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
84# SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
85
86#   User agents such as web browsers are not configured for the user's
87#   own preference of either security or performance, therefore this
88#   must be the prerogative of the web server administrator who manages
89#   cpu load versus confidentiality, so enforce the server's cipher order.
90SSLHonorCipherOrder on
91
92#   SSL Protocol support:
93#   List the protocol versions which clients are allowed to connect with.
94#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
95#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
96#   protocol or later should remain in use.
97####ORIGINAL
98####SSLProtocol all -SSLv3
99####SSLProxyProtocol all -SSLv3
100###### Tighted up
101###### SSLProtocol +TLSv1.2 +TLSv1.3
102###### SSLProxyProtocol +TLSv1.2 +TLSv1.3
103######### what I have been using  SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.3
104######### what I have been using  SSLProxyProtocol +TLSv1.2
105SSLProtocol all -SSLv3
106SSLProxyProtocol all -SSLv3
107
108#   Pass Phrase Dialog:
109#   Configure the pass phrase gathering process.
110#   The filtering dialog program (`builtin' is an internal
111#   terminal dialog) has to provide the pass phrase on stdout.
112SSLPassPhraseDialog  builtin
113
114#   Inter-Process Session Cache:
115#   Configure the SSL Session Cache: First the mechanism
116#   to use and second the expiring timeout (in seconds).
117#SSLSessionCache         "dbm:${SRVROOT}/logs/ssl_scache"
118SSLSessionCache        "shmcb:${SRVROOT}/logs/ssl_scache(512000)"
119SSLSessionCacheTimeout  300
120
121#   OCSP Stapling (requires OpenSSL 0.9.8h or later)
122#
123#   This feature is disabled by default and requires at least
124#   the two directives SSLUseStapling and SSLStaplingCache.
125#   Refer to the documentation on OCSP Stapling in the SSL/TLS
126#   How-To for more information.
127#
128#   Enable stapling for all SSL-enabled servers:
129#SSLUseStapling On
130
131#   Define a relatively small cache for OCSP Stapling using
132#   the same mechanism that is used for the SSL session cache
133#   above.  If stapling is used with more than a few certificates,
134#   the size may need to be increased.  (AH01929 will be logged.)
135#SSLStaplingCache "shmcb:${SRVROOT}/logs/ssl_stapling(32768)"
136
137#   Seconds before valid OCSP responses are expired from the cache
138#SSLStaplingStandardCacheTimeout 3600
139
140#   Seconds before invalid OCSP responses are expired from the cache
141#SSLStaplingErrorCacheTimeout 600
142
143##
144## SSL Virtual Host Context
145##
146
147#<VirtualHost _default_:443>
148
149#   General setup for the virtual host
150#DocumentRoot "${SRVROOT}/htdocs"
151#ServerName www.example.com:443
152#ServerAdmin admin@example.com
153#ErrorLog "${SRVROOT}/logs/error.log"
154#TransferLog "${SRVROOT}/logs/access.log"
155
156#   SSL Engine Switch:
157#   Enable/Disable SSL for this virtual host.
158#SSLEngine on
159
160#   Server Certificate:
161#   Point SSLCertificateFile at a PEM encoded certificate.  If
162#   the certificate is encrypted, then you will be prompted for a
163#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
164#   in mind that if you have both an RSA and a DSA certificate you
165#   can configure both in parallel (to also allow the use of DSA
166#   ciphers, etc.)
167#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
168#   require an ECC certificate which can also be configured in
169#   parallel.
170#SSLCertificateFile "${SRVROOT}/conf/server.crt"
171#SSLCertificateFile "${SRVROOT}/conf/server-dsa.crt"
172#SSLCertificateFile "${SRVROOT}/conf/server-ecc.crt"
173
174#   Server Private Key:
175#   If the key is not combined with the certificate, use this
176#   directive to point at the key file.  Keep in mind that if
177#   you've both a RSA and a DSA private key you can configure
178#   both in parallel (to also allow the use of DSA ciphers, etc.)
179#   ECC keys, when in use, can also be configured in parallel
180#SSLCertificateKeyFile "${SRVROOT}/conf/server.key"
181#SSLCertificateKeyFile "${SRVROOT}/conf/server-dsa.key"
182#SSLCertificateKeyFile "${SRVROOT}/conf/server-ecc.key"
183
184#   Server Certificate Chain:
185#   Point SSLCertificateChainFile at a file containing the
186#   concatenation of PEM encoded CA certificates which form the
187#   certificate chain for the server certificate. Alternatively
188#   the referenced file can be the same as SSLCertificateFile
189#   when the CA certificates are directly appended to the server
190#   certificate for convenience.
191#SSLCertificateChainFile "${SRVROOT}/conf/server-ca.crt"
192
193#   Certificate Authority (CA):
194#   Set the CA certificate verification path where to find CA
195#   certificates for client authentication or alternatively one
196#   huge file containing all of them (file must be PEM encoded)
197#   Note: Inside SSLCACertificatePath you need hash symlinks
198#         to point to the certificate files. Use the provided
199#         Makefile to update the hash symlinks after changes.
200#SSLCACertificatePath "${SRVROOT}/conf/ssl.crt"
201#SSLCACertificateFile "${SRVROOT}/conf/ssl.crt/ca-bundle.crt"
202
203#   Certificate Revocation Lists (CRL):
204#   Set the CA revocation path where to find CA CRLs for client
205#   authentication or alternatively one huge file containing all
206#   of them (file must be PEM encoded).
207#   The CRL checking mode needs to be configured explicitly
208#   through SSLCARevocationCheck (defaults to "none" otherwise).
209#   Note: Inside SSLCARevocationPath you need hash symlinks
210#         to point to the certificate files. Use the provided
211#         Makefile to update the hash symlinks after changes.
212#SSLCARevocationPath "${SRVROOT}/conf/ssl.crl"
213#SSLCARevocationFile "${SRVROOT}/conf/ssl.crl/ca-bundle.crl"
214#SSLCARevocationCheck chain
215
216#   Client Authentication (Type):
217#   Client certificate verification type and depth.  Types are
218#   none, optional, require and optional_no_ca.  Depth is a
219#   number which specifies how deeply to verify the certificate
220#   issuer chain before deciding the certificate is not valid.
221#SSLVerifyClient require
222#SSLVerifyDepth  10
223
224#   TLS-SRP mutual authentication:
225#   Enable TLS-SRP and set the path to the OpenSSL SRP verifier
226#   file (containing login information for SRP user accounts).
227#   Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
228#   detailed instructions on creating this file. Example:
229#   "openssl srp -srpvfile ${SRVROOT}/conf/passwd.srpv -add username"
230#SSLSRPVerifierFile "${SRVROOT}/conf/passwd.srpv"
231
232#   Access Control:
233#   With SSLRequire you can do per-directory access control based
234#   on arbitrary complex boolean expressions containing server
235#   variable checks and other lookup directives.  The syntax is a
236#   mixture between C and Perl.  See the mod_ssl documentation
237#   for more details.
238#<Location />
239#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
240#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
241#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
242#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
243#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
244#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
245#</Location>
246
247#   SSL Engine Options:
248#   Set various options for the SSL engine.
249#   o FakeBasicAuth:
250#     Translate the client X.509 into a Basic Authorisation.  This means that
251#     the standard Auth/DBMAuth methods can be used for access control.  The
252#     user name is the `one line' version of the client's X.509 certificate.
253#     Note that no password is obtained from the user. Every entry in the user
254#     file needs this password: `xxj31ZMTZzkVA'.
255#   o ExportCertData:
256#     This exports two additional environment variables: SSL_CLIENT_CERT and
257#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
258#     server (always existing) and the client (only existing when client
259#     authentication is used). This can be used to import the certificates
260#     into CGI scripts.
261#   o StdEnvVars:
262#     This exports the standard SSL/TLS related `SSL_*' environment variables.
263#     Per default this exportation is switched off for performance reasons,
264#     because the extraction step is an expensive operation and is usually
265#     useless for serving static content. So one usually enables the
266#     exportation for CGI and SSI requests only.
267#   o StrictRequire:
268#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
269#     under a "Satisfy any" situation, i.e. when it applies access is denied
270#     and no other module can change it.
271#   o OptRenegotiate:
272#     This enables optimized SSL connection renegotiation handling when SSL
273#     directives are used in per-directory context.
274#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
275#<FilesMatch "\.(cgi|shtml|phtml|php)$">
276#    SSLOptions +StdEnvVars
277#</FilesMatch>
278#<Directory "${SRVROOT}/cgi-bin">
279#    SSLOptions +StdEnvVars
280#</Directory>
281
282#   SSL Protocol Adjustments:
283#   The safe and default but still SSL/TLS standard compliant shutdown
284#   approach is that mod_ssl sends the close notify alert but doesn't wait for
285#   the close notify alert from client. When you need a different shutdown
286#   approach you can use one of the following variables:
287#   o ssl-unclean-shutdown:
288#     This forces an unclean shutdown when the connection is closed, i.e. no
289#     SSL close notify alert is sent or allowed to be received.  This violates
290#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
291#     this when you receive I/O errors because of the standard approach where
292#     mod_ssl sends the close notify alert.
293#   o ssl-accurate-shutdown:
294#     This forces an accurate shutdown when the connection is closed, i.e. a
295#     SSL close notify alert is send and mod_ssl waits for the close notify
296#     alert of the client. This is 100% SSL/TLS standard compliant, but in
297#     practice often causes hanging connections with brain-dead browsers. Use
298#     this only for browsers where you know that their SSL implementation
299#     works correctly.
300#   Notice: Most problems of broken clients are also related to the HTTP
301#   keep-alive facility, so you usually additionally want to disable
302#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
303#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
304#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
305#   "force-response-1.0" for this.
306#BrowserMatch "MSIE [2-5]" \
307#         nokeepalive ssl-unclean-shutdown \
308#         downgrade-1.0 force-response-1.0
309
310#   Per-Server Logging:
311#   The home of a custom SSL log file. Use this when you want a
312#   compact non-error SSL logfile on a virtual host basis.
313#CustomLog "${SRVROOT}/logs/ssl_request.log" \
314          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
315
316#</VirtualHost>                                 
Note: See TracBrowser for help on using the repository browser.