Patrick
/
server_config
Слідкувати 1
В обрані 0
Форк 0
Код Проблеми 0 Запити на злиття 0 Релізи 0 Вікі Активність
service configuration files that needs to be saved just incase the server got lost someday by the cloud provider.
Ви не можете вибрати більше 25 тем Теми мають розпочинатися з літери або цифри, можуть містити дефіси (-) і не повинні перевищувати 35 символів.
11 Коміти
1 Гілка
42KB
Дерево: 0ec8ffcdb8
Гілки Теги
${ item.name }
Створити гілку ${ searchTerm }
з '0ec8ffcdb8'
${ noResults }
server_config/lawipac.com/etc/apache2/sites-enabled/draw-lawipac-ssl.conf

147 lines
7.0KB
Неформатований Blame Історія 

  1. <IfModule mod_ssl.c>

  2. 	<VirtualHost _default_:443>

  3. 		ServerName draw.lawipac.com

  4. 		ServerAdmin sp@lawipac.com

  5. 

  6. 		ProxyPass / http://s-gate.lawipac.com:38080/

  7. 		ProxyPassReverse / http://s-gate.lawipac.com:38080/

  8. 

  9. 		# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,

  10. 		# error, crit, alert, emerg.

  11. 		# It is also possible to configure the loglevel for particular

  12. 		# modules, e.g.

  13. 		#LogLevel info ssl:warn

  14. 

  15. 		ErrorLog ${APACHE_LOG_DIR}/draw.lawipac.com.error.log

  16. 		CustomLog ${APACHE_LOG_DIR}/draw.lawipac.com.access.log combined

  17. 

  18. 		# For most configuration files from conf-available/, which are

  19. 		# enabled or disabled at a global level, it is possible to

  20. 		# include a line for only one particular virtual host. For example the

  21. 		# following line enables the CGI configuration for this host only

  22. 		# after it has been globally disabled with "a2disconf".

  23. 		#Include conf-available/serve-cgi-bin.conf

  24. 

  25. 		#   SSL Engine Switch:

  26. 		#   Enable/Disable SSL for this virtual host.

  27. 		SSLEngine on

  28. 

  29. 		#   A self-signed (snakeoil) certificate can be created by installing

  30. 		#   the ssl-cert package. See

  31. 		#   /usr/share/doc/apache2/README.Debian.gz for more info.

  32. 		#   If both key and certificate are stored in the same file, only the

  33. 		#   SSLCertificateFile directive is needed.

  34. 		#SSLCertificateFile	/etc/ssl/certs/ssl-cert-snakeoil.pem

  35. 		#SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

  36. 		#SSLCertificateFile    /etc/apache2/myssl_certs/lawipac.com.crt

  37. 	        #SSLCertificateKeyFile /etc/apache2/myssl_certs/lawipac.com.key

  38. 		Include /etc/letsencrypt/options-ssl-apache.conf

  39. 

  40. 

  41. 		#   Server Certificate Chain:

  42. 		#   Point SSLCertificateChainFile at a file containing the

  43. 		#   concatenation of PEM encoded CA certificates which form the

  44. 		#   certificate chain for the server certificate. Alternatively

  45. 		#   the referenced file can be the same as SSLCertificateFile

  46. 		#   when the CA certificates are directly appended to the server

  47. 		#   certificate for convinience.

  48. 		#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

  49. 		#SSLCertificateChainFile /etc/apache2/myssl_certs/startcom_sub.class1.server.ca.pem

  50. 		#SSLCertificateChainFile /etc/apache2/myssl_certs/startcom_1_root_boundle.crt

  51. 

  52. 		#   Certificate Authority (CA):

  53. 		#   Set the CA certificate verification path where to find CA

  54. 		#   certificates for client authentication or alternatively one

  55. 		#   huge file containing all of them (file must be PEM encoded)

  56. 		#   Note: Inside SSLCACertificatePath you need hash symlinks

  57. 		#		 to point to the certificate files. Use the provided

  58. 		#		 Makefile to update the hash symlinks after changes.

  59. 		#SSLCACertificatePath /etc/ssl/certs/

  60. 		#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

  61. 

  62. 		#   Certificate Revocation Lists (CRL):

  63. 		#   Set the CA revocation path where to find CA CRLs for client

  64. 		#   authentication or alternatively one huge file containing all

  65. 		#   of them (file must be PEM encoded)

  66. 		#   Note: Inside SSLCARevocationPath you need hash symlinks

  67. 		#		 to point to the certificate files. Use the provided

  68. 		#		 Makefile to update the hash symlinks after changes.

  69. 		#SSLCARevocationPath /etc/apache2/ssl.crl/

  70. 		#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl

  71. 

  72. 		#   Client Authentication (Type):

  73. 		#   Client certificate verification type and depth.  Types are

  74. 		#   none, optional, require and optional_no_ca.  Depth is a

  75. 		#   number which specifies how deeply to verify the certificate

  76. 		#   issuer chain before deciding the certificate is not valid.

  77. 		#SSLVerifyClient require

  78. 		#SSLVerifyDepth  10

  79. 

  80. 		#   SSL Engine Options:

  81. 		#   Set various options for the SSL engine.

  82. 		#   o FakeBasicAuth:

  83. 		#	 Translate the client X.509 into a Basic Authorisation.  This means that

  84. 		#	 the standard Auth/DBMAuth methods can be used for access control.  The

  85. 		#	 user name is the `one line' version of the client's X.509 certificate.

  86. 		#	 Note that no password is obtained from the user. Every entry in the user

  87. 		#	 file needs this password: `xxj31ZMTZzkVA'.

  88. 		#   o ExportCertData:

  89. 		#	 This exports two additional environment variables: SSL_CLIENT_CERT and

  90. 		#	 SSL_SERVER_CERT. These contain the PEM-encoded certificates of the

  91. 		#	 server (always existing) and the client (only existing when client

  92. 		#	 authentication is used). This can be used to import the certificates

  93. 		#	 into CGI scripts.

  94. 		#   o StdEnvVars:

  95. 		#	 This exports the standard SSL/TLS related `SSL_*' environment variables.

  96. 		#	 Per default this exportation is switched off for performance reasons,

  97. 		#	 because the extraction step is an expensive operation and is usually

  98. 		#	 useless for serving static content. So one usually enables the

  99. 		#	 exportation for CGI and SSI requests only.

  100. 		#   o OptRenegotiate:

  101. 		#	 This enables optimized SSL connection renegotiation handling when SSL

  102. 		#	 directives are used in per-directory context.

  103. 		#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

  104. 		<FilesMatch "\.(cgi|shtml|phtml|php)$">

  105. 				SSLOptions +StdEnvVars

  106. 		</FilesMatch>

  107. 		<Directory /usr/lib/cgi-bin>

  108. 				SSLOptions +StdEnvVars

  109. 		</Directory>

  110. 

  111. 		#   SSL Protocol Adjustments:

  112. 		#   The safe and default but still SSL/TLS standard compliant shutdown

  113. 		#   approach is that mod_ssl sends the close notify alert but doesn't wait for

  114. 		#   the close notify alert from client. When you need a different shutdown

  115. 		#   approach you can use one of the following variables:

  116. 		#   o ssl-unclean-shutdown:

  117. 		#	 This forces an unclean shutdown when the connection is closed, i.e. no

  118. 		#	 SSL close notify alert is send or allowed to received.  This violates

  119. 		#	 the SSL/TLS standard but is needed for some brain-dead browsers. Use

  120. 		#	 this when you receive I/O errors because of the standard approach where

  121. 		#	 mod_ssl sends the close notify alert.

  122. 		#   o ssl-accurate-shutdown:

  123. 		#	 This forces an accurate shutdown when the connection is closed, i.e. a

  124. 		#	 SSL close notify alert is send and mod_ssl waits for the close notify

  125. 		#	 alert of the client. This is 100% SSL/TLS standard compliant, but in

  126. 		#	 practice often causes hanging connections with brain-dead browsers. Use

  127. 		#	 this only for browsers where you know that their SSL implementation

  128. 		#	 works correctly.

  129. 		#   Notice: Most problems of broken clients are also related to the HTTP

  130. 		#   keep-alive facility, so you usually additionally want to disable

  131. 		#   keep-alive for those clients, too. Use variable "nokeepalive" for this.

  132. 		#   Similarly, one has to force some clients to use HTTP/1.0 to workaround

  133. 		#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and

  134. 		#   "force-response-1.0" for this.

  135. 		BrowserMatch "MSIE [2-6]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

  136. 		# MSIE 7 and newer should be able to use keepalive

  137. 		BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

  138. 

  139. 		Include /etc/letsencrypt/options-ssl-apache.conf

  140. 		SSLCertificateFile /etc/letsencrypt/live/lawipac.com/fullchain.pem

  141. SSLCertificateKeyFile /etc/letsencrypt/live/lawipac.com/privkey.pem

  142. Include /etc/letsencrypt/options-ssl-apache.conf

  143. 	</VirtualHost>

  144. </IfModule>

  145. 

  146. # vim: syntax=apache ts=4 sw=4 sts=4 sr noet