1 LoadModule ssl_module modules/libssl.so
4 ##--------------------------------------------------------------------------
5 ## Add additional SSL configuration directives which provide a
6 ## robust default configuration: virtual server on port 443
8 ##--------------------------------------------------------------------------
12 ## When we also provide SSL we have to listen to the
13 ## standard HTTP port (see above) and to the HTTPS port
20 ## All SSL configuration in this context applies both to
21 ## the main server and all SSL-enabled virtual hosts.
25 # Configure the pass phrase gathering process.
26 # The filtering dialog program (`builtin' is a internal
27 # terminal dialog) has to provide the pass phrase on stdout.
28 SSLPassPhraseDialog builtin
30 # Inter-Process Session Cache:
31 # Configure the SSL Session Cache: First either `none'
32 # or `dbm:/path/to/file' for the mechanism to use and
33 # second the expiring timeout (in seconds).
35 #SSLSessionCache dbm:logs/ssl_scache
36 SSLSessionCache shm:/var/run/ssl_scache(512000)
37 SSLSessionCacheTimeout 300
39 # FOLLOW SECURE DEFAULTS: https://wiki.mozilla.org/Security/Server_Side_TLS
41 # Usable SSL protocol flavors:
42 # This directive can be used to control the SSL protocol flavors mod_ssl
43 # should use when establishing its server environment. Clients then can only
44 # connect with one of the provided protocols.
45 SSLProtocol all -SSLv2 -SSLv3
48 # Configure the path to the mutual explusion semaphore the
49 # SSL engine uses internally for inter-process synchronization.
50 SSLMutex file:/var/run/ssl_mutex
52 # Pseudo Random Number Generator (PRNG):
53 # Configure one or more sources to seed the PRNG of the
54 # SSL library. The seed data should be of good random quality.
55 SSLRandomSeed startup builtin
56 SSLRandomSeed connect builtin
57 #SSLRandomSeed startup file:/dev/random 512
58 #SSLRandomSeed startup file:/dev/urandom 512
59 #SSLRandomSeed connect file:/dev/random 512
60 #SSLRandomSeed connect file:/dev/urandom 512
63 # The home of the dedicated SSL protocol logfile. Errors are
64 # additionally duplicated in the general error log file. Put
65 # this somewhere where it cannot be used for symlink attacks on
66 # a real server (i.e. somewhere where only root can write).
67 # Log levels are (ascending order: higher ones include lower ones):
68 # none, error, warn, info, trace, debug.
69 SSLLog logs/ssl_engine_log
72 <VirtualHost _default_:443>
74 #SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
75 SSLCertificateFile /etc/apache/server.crt
76 SSLCertificateKeyFile /etc/apache/server.key
77 #SSLCertificateChainFile /etc/apache/conf/ssl.crt/ca.crt
78 #SSLCACertificatePath /etc/apache/conf/ssl.crt
79 #SSLCACertificateFile /etc/apache/conf/ssl.crt/ca-bundle.crt
80 #SSLCARevocationPath /etc/apache/conf/ssl.crl
81 #SSLCARevocationFile /etc/apache/conf/ssl.crl/ca-bundle.crl
82 #SSLVerifyClient require
85 #SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
86 <Files ~ "\.(cgi|shtml)$">
87 SSLOptions +StdEnvVars
89 <Directory "/home/services/apache/html/cgi-bin">
90 SSLOptions +StdEnvVars
93 <IfModule mod_setenvif.c>
94 SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
97 #<IfModule mod_log_config.c>
98 # CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
99 # # enable common log too, otherwise you be suprised of no access logs
100 # CustomLog logs/access_log common