Here's the baseline SSL conf I use with Apache:
Here're a bunch of security tips for Apache:
- https://geekflare.com/10-best-practices-to-secure-and-harden-your-apache-web-server
- https://www.petefreitag.com/item/505.cfm
- https://www.techrepublic.com/article/how-to-secure-your-apache-2-server-in-four-steps
- https://help.dreamhost.com/hc/en-us/articles/226327268-The-most-important-steps-to-take-to-make-an-Apache-server-more-secure
- https://www.cisecurity.org/benchmark/apache_http_server
- https://www.tecmint.com/apache-security-tips
And for IIS:
- https://calcomsoftware.com/hardening-iis-server-guide
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd450371(v=ws.10)?redirectedfrom=MSDN
- https://docs.microsoft.com/en-us/previous-versions/tn-archive/dd163531(v=technet.10)?redirectedfrom=MSDN
- https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Exchange-TLS-038-SSL-Best-Practices/ba-p/603798
- https://www.cisecurity.org/benchmark/microsoft_iis
- https://www.upguard.com/articles/10-steps-for-improving-iis-security
- https://www.davidfroud.com/pci-going-beyond-the-standard-part-8-configuration-standards
- https://support.microsoft.com/en-us/help/324069/how-to-set-up-an-https-service-in-iis
And, of course, there are guides from places like DISA:
September 26, 2019 at 09:44AM
via reddit https://www.reddit.com/r/security/comments/d94b4y/webserver_baselines/f1i3pog?utm_source=ifttt