{"id":3159,"date":"2017-07-07T11:36:48","date_gmt":"2017-07-07T15:36:48","guid":{"rendered":"https:\/\/antipaucity.com\/?p=3159"},"modified":"2017-07-07T11:36:48","modified_gmt":"2017-07-07T15:36:48","slug":"ssl-configuration-for-apache-2-4-on-centos-7-with-lets-encrypt","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=3159","title":{"rendered":"ssl configuration for apache 2.4 on centos 7 with let’s encrypt"},"content":{"rendered":"

In follow-up to previous posts<\/a> I’ve had about SSL (specifically with Let’s Encrypt<\/a>), here is the set of {{SSL}} configurations I use with all my sites. These, if used correctly,\u00a0should<\/em> score you an “A+” with no warnings from ssllabs.com.<\/a> Note: I have an improved entropy<\/a> package installed (twuewand). This is adapted from the Mozilla config generator<\/a> with specific options added for individual sites and\/or to match Let’s Encrypt’s recommendations.<\/p>\n

Please note: you will need to modify the config files to represent your own domains, if you choose to use these as models.<\/p>\n

[\/etc\/httpd\/conf.d\/defaults.conf]<\/h3>\n
#SSL options for all sites\nListen 443\nSSLPassPhraseDialog  builtin\nSSLSessionCache         shmcb:\/var\/cache\/mod_ssl\/scache(512000)\nSSLSessionCacheTimeout  300\nMutex sysvsem default\nSSLRandomSeed startup builtin\nSSLRandomSeed startup file:\/dev\/urandom  1024\n# requires twuewand to be installed\nSSLRandomSeed startup exec:\/bin\/twuewand 64\nSSLRandomSeed connect builtin\nSSLRandomSeed connect file:\/dev\/urandom 1024\nSSLCryptoDevice builtin\n# the SSLSessionTickets directive should work - but on Apache 2.4.6-45, it does not\n#SSLSessionTickets       off\nSSLCompression          off\nSSLHonorCipherOrder\ton\n# there may be an unusual use case for enabling TLS v1.1 or 1 - but I don't know what that would be\nSSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1\nSSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256\nSSLOptions +StrictRequire\nSSLUseStapling on\nSSLStaplingResponderTimeout 5\nSSLStaplingReturnResponderErrors off\nSSLStaplingCache        shmcb:\/var\/run\/ocsp(128000)\n\n#all unknown requests get domain.tld (over http)\n<VirtualHost *:80>\n    DocumentRoot \/var\/html\n    ServerName domain.tld\n    ServerAlias domain.tld *.domain.tld\n    ErrorLog logs\/domain-error_log\n    CustomLog logs\/domain-access_log combined\n    ServerAdmin user@domain.tld\n    <Directory \"\/var\/html\">\n         Options All +Indexes +FollowSymLinks\n         AllowOverride All\n         Order allow,deny\n         Allow from all\n    <\/Directory>\n<\/VirtualHost>\n\nSetOutputFilter DEFLATE\nAddOutputFilterByType DEFLATE text\/html text\/plain text\/xml text\/javascript text\/css text\/php\n<\/pre>\n
[\/etc\/httpd\/conf.d\/z-[sub-]domain-tld.conf]<\/h3>\n
<Virtualhost *:80>\n    ServerName domain.tld\n# could use * instead of www if you don't use subdomains for anything special\/separate\n    ServerAlias domain.tld www.domain.tld\n    Redirect permanent \/ https:\/\/domain.tld\/\n<\/VirtualHost>\n\n<VirtualHost *:443>\n    SSLCertificateFile \/etc\/letsencrypt\/live\/domain.tld\/cert.pem\n    SSLCertificateKeyFile \/etc\/letsencrypt\/live\/domain.tld\/privkey.pem\n# if you put \"fullchain.pem\" here, you will get an error from ssllabs\n    SSLCertificateChainFile \/etc\/letsencrypt\/live\/domain.tld\/chain.pem\n    DocumentRoot \/var\/www\/domain\n    ServerName domain.tld\n    ErrorLog logs\/domain-error_log\n    CustomLog logs\/domain-access_log \\\n          \"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \\\"%r\\\" %b\"\n    ServerAdmin user@domain.tld\n\n# could put this in defaults.conf - I prefer it in each site config\n    SSLEngine on\n\n<Files ~ \"\\.(cgi|shtml|phtml|php3?)$\">\n    SSLOptions +StdEnvVars\n<\/files>\n<Directory \"\/var\/www\/cgi-bin\">\n    SSLOptions +StdEnvVars\n<\/Directory>\n\nSetEnvIf User-Agent \".*MSIE.*\" \\\n         nokeepalive ssl-unclean-shutdown \\\n         downgrade-1.0 force-response-1.0\n\n    <Directory \"\/var\/www\/domain\">\n         Options All +Indexes +FollowSymLinks\n         AllowOverride All\n         Order allow,deny\n         Allow from all\n    <\/Directory>\n\n<\/VirtualHost>\n<\/pre>\n
I use the z....conf<\/code> formatting to ensure all site-specific configs are loaded after everything else. That conveniently breaks every site into its own config file, too.<\/p>\n
The config file for a non-https site is much simpler:<\/p>\n
<VirtualHost *:80>\n    DocumentRoot \/var\/www\/domain\n    ServerName domain.tld\n    ServerAlias domain.tld *.domain.tld\n    ErrorLog logs\/domain-error_log\n    CustomLog logs\/domain-access_log combined\n    ServerAdmin user@domain.tld\n    <Directory \"\/var\/www\/domain\">\n         Options All +Indexes +FollowSymLinks\n         AllowOverride All\n         Order allow,deny\n         Allow from all\n    <\/Directory>\n<\/VirtualHost>\n<\/pre>\n
If you’re running something like Nextcloud<\/a>, you may want to turn on Header always set Strict-Transport-Security \"max-age=15552000; includeSubDomains\"<\/code> in the <VirtualHost&gt directive for the site. I haven’t decided yet if I should put this in every<\/em> SSL-enabled site’s configs or not.<\/p>\n","protected":false},"excerpt":{"rendered":"
In follow-up to previous posts I’ve had about SSL (specifically with Let’s Encrypt), here is the set of {{SSL}} configurations I use with all my sites. These, if used correctly,\u00a0should score you an “A+” with no warnings from ssllabs.com. Note: I have an improved entropy package installed (twuewand). This is adapted from the Mozilla config …
Continue reading ssl configuration for apache 2.4 on centos 7 with let’s encrypt<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[41,46],"tags":[97,166,450,713],"keyring_services":[],"class_list":["post-3159","post","type-post","status-publish","format-standard","hentry","category-technical","category-update","tag-apache","tag-centos","tag-linux","tag-ssl"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3159"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3159\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3159"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=3159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}