add ssl dir where to keep ssl related files

secure permission, to ensure files with weak permissions aren't
accessible

diff --git a/lighttpd.spec b/lighttpd.spec
index 92b27d80118954e37a9aba6f596bd024625d477e..1d3fe350719c52563e823e19228caa39d7c5d6d9 100644 (file)
--- a/lighttpd.spec
+++ b/lighttpd.spec
@@ -1005,7 +1005,7 @@ export LIGHTTPD_TEST_PORT=$((2048 + RANDOM % 10))
 %install
 rm -rf $RPM_BUILD_ROOT
 install -d $RPM_BUILD_ROOT{%{_lighttpddir}/{cgi-bin,html},/etc/{logrotate.d,rc.d/init.d,sysconfig,monit}} \
-       $RPM_BUILD_ROOT%{_sysconfdir}/{conf,vhosts,webapps}.d \
+       $RPM_BUILD_ROOT%{_sysconfdir}/{{conf,vhosts,webapps}.d,ssl} \
        $RPM_BUILD_ROOT{/var/log/{%{name},archive/%{name}},/var/run/%{name}} \
        $RPM_BUILD_ROOT%{_datadir}/lighttpd/errordocs \
        $RPM_BUILD_ROOT/var/lib/lighttpd \
@@ -1245,6 +1245,7 @@ fi
 %dir %attr(750,root,root) %{_sysconfdir}/conf.d
 %dir %attr(750,root,root) %{_sysconfdir}/vhosts.d
 %dir %attr(750,root,root) %{_sysconfdir}/webapps.d
+%dir %attr(700,root,root) %{_sysconfdir}/ssl
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}.conf
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/mime.types.conf
 %attr(640,root,lighttpd) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/*.user

diff --git a/ssl.conf b/ssl.conf
index 41564f520651f02552664e115a90877f09344e49..c63822bd06a60656569919aab18144b21b8d054d 100644 (file)
--- a/ssl.conf
+++ b/ssl.conf
@@ -15,12 +15,12 @@ $SERVER["socket"] == ":443" {
        # (Should contain both the private key and the certificate)
        ## If you have a .crt and a .key file, cat them together into a single PEM file:
        ## $ cat lighttpd.key lighttpd.crt > lighttpd.pem
-       ssl.pemfile = "/etc/lighttpd/server.pem"
+       ssl.pemfile = "/etc/lighttpd/ssl/server.pem"
        # ssl.ca-file: path to the CA file for support of chained certificates
-#      ssl.ca-file = "/etc/certs/ca-certificates.crt"
+#      ssl.ca-file = "/etc/lighttpd/ssl/chain.pem"
 
        # for DH/DHE ciphers, dhparam should be >= 2048-bit
-#      ssl.dh-file = "/path/to/dhparam.pem"
+#      ssl.dh-file = "/etc/lighttpd/ssl/dhparam.pem"
        # ECDH/ECDHE ciphers curve strength (see `openssl ecparam -list_curves`)
 #      ssl.ec-curve = "secp384r1"
        # Compression is by default off at compile-time, but use if needed