diff options
author | Stefan Fritsch <sf@sfritsch.de> | 2014-03-29 21:56:19 +0100 |
---|---|---|
committer | Stefan Fritsch <sf@sfritsch.de> | 2014-03-29 21:56:45 +0100 |
commit | 2a463b3cd73c32ee9dcd508248d0194923f435f4 (patch) | |
tree | 2ff478255a77a55031056790918b6f983bb7b20a /docs/manual/ssl/ssl_howto.html.en | |
parent | 86d5cc79d9d6750da8771fdb0c9ab22c19b8ad45 (diff) | |
download | apache2-upstream/2.4.9.tar.gz |
Imported Upstream version 2.4.9upstream/2.4.9
Diffstat (limited to 'docs/manual/ssl/ssl_howto.html.en')
-rw-r--r-- | docs/manual/ssl/ssl_howto.html.en | 59 |
1 files changed, 20 insertions, 39 deletions
diff --git a/docs/manual/ssl/ssl_howto.html.en b/docs/manual/ssl/ssl_howto.html.en index 4f1a6725..fb3e3897 100644 --- a/docs/manual/ssl/ssl_howto.html.en +++ b/docs/manual/ssl/ssl_howto.html.en @@ -9,7 +9,7 @@ <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" /> -<script src="../style/scripts/prettify.js" type="text/javascript"> +<script src="../style/scripts/prettify.min.js" type="text/javascript"> </script> <link href="../images/favicon.ico" rel="shortcut icon" /></head> @@ -44,8 +44,7 @@ before progressing to the advanced techniques.</p> <p>Your SSL configuration will need to contain, at minimum, the following directives.</p> -<pre class="prettyprint lang-config"> -LoadModule ssl_module modules/mod_ssl.so +<pre class="prettyprint lang-config">LoadModule ssl_module modules/mod_ssl.so Listen 443 <VirtualHost *:443> @@ -53,8 +52,7 @@ Listen 443 SSLEngine on SSLCertificateFile /path/to/www.example.com.cert SSLCertificateKeyFile /path/to/www.example.com.key -</VirtualHost> -</pre> +</VirtualHost></pre> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -71,19 +69,15 @@ requires a strong cipher for access to a particular URL?</a></li> only?</a></h3> <p>The following enables only the strongest ciphers:</p> - <pre class="prettyprint lang-config"> - SSLCipherSuite HIGH:!aNULL:!MD5 - </pre> + <pre class="prettyprint lang-config">SSLCipherSuite HIGH:!aNULL:!MD5</pre> <p>While with the following configuration you specify a preference for specific speed-optimized ciphers (which will be selected by mod_ssl, provided that they are supported by the client):</p> - <pre class="prettyprint lang-config"> -SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 -SSLHonorCipherOrder on - </pre> + <pre class="prettyprint lang-config">SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 +SSLHonorCipherOrder on</pre> @@ -97,16 +91,14 @@ URL?</a></h3> blocks, to give a per-directory solution, and can automatically force a renegotiation of the SSL parameters to meet the new configuration. This can be done as follows:</p> - <pre class="prettyprint lang-config"> -# be liberal in general + <pre class="prettyprint lang-config"># be liberal in general SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL <Location /strong/area> # but https://hostname/strong/area/ and below # requires strong ciphers SSLCipherSuite HIGH:!aNULL:!MD5 -</Location> - </pre> +</Location></pre> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -132,13 +124,11 @@ Intranet website, for clients coming from the Internet?</a></li> need to do is to create client certificates signed by your own CA certificate (<code>ca.crt</code>) and then verify the clients against this certificate.</p> - <pre class="prettyprint lang-config"> -# require a client certificate which has to be directly + <pre class="prettyprint lang-config"># require a client certificate which has to be directly # signed by our CA certificate in ca.crt SSLVerifyClient require SSLVerifyDepth 1 -SSLCACertificateFile conf/ssl.crt/ca.crt - </pre> +SSLCACertificateFile conf/ssl.crt/ca.crt</pre> @@ -150,15 +140,13 @@ SSLCACertificateFile conf/ssl.crt/ca.crt you can use the per-directory reconfiguration features of <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>:</p> - <pre class="prettyprint lang-config"> -SSLVerifyClient none + <pre class="prettyprint lang-config">SSLVerifyClient none SSLCACertificateFile conf/ssl.crt/ca.crt <Location /secure/area> SSLVerifyClient require SSLVerifyDepth 1 -</Location> - </pre> +</Location></pre> @@ -178,8 +166,7 @@ SSLVerifyDepth 1 you should establish a password database containing <em>all</em> clients allowed, as follows:</p> - <pre class="prettyprint lang-config"> -SSLVerifyClient none + <pre class="prettyprint lang-config">SSLVerifyClient none SSLCACertificateFile conf/ssl.crt/ca.crt SSLCACertificatePath conf/ssl.crt @@ -193,16 +180,14 @@ SSLCACertificatePath conf/ssl.crt AuthBasicProvider file AuthUserFile /usr/local/apache2/conf/httpd.passwd Require valid-user -</Directory> - </pre> +</Directory></pre> <p>The password used in this example is the DES encrypted string "password". See the <code class="directive"><a href="../mod/mod_ssl.html#ssloptions">SSLOptions</a></code> docs for more information.</p> - <div class="example"><h3>httpd.passwd</h3><pre> -/C=DE/L=Munich/O=Snake Oil, Ltd./OU=Staff/CN=Foo:xxj31ZMTZzkVA + <div class="example"><h3>httpd.passwd</h3><pre>/C=DE/L=Munich/O=Snake Oil, Ltd./OU=Staff/CN=Foo:xxj31ZMTZzkVA /C=US/L=S.F./O=Snake Oil, Ltd./OU=CA/CN=Bar:xxj31ZMTZzkVA /C=US/L=L.A./O=Snake Oil, Ltd./OU=Dev/CN=Quux:xxj31ZMTZzkVA</pre></div> @@ -210,8 +195,7 @@ SSLCACertificatePath conf/ssl.crt into the DN, you can match them more easily using <code class="directive"><a href="../mod/mod_ssl.html#sslrequire">SSLRequire</a></code>, as follows:</p> - <pre class="prettyprint lang-config"> -SSLVerifyClient none + <pre class="prettyprint lang-config">SSLVerifyClient none SSLCACertificateFile conf/ssl.crt/ca.crt SSLCACertificatePath conf/ssl.crt @@ -222,8 +206,7 @@ SSLCACertificatePath conf/ssl.crt SSLRequireSSL SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} -</Directory> - </pre> +</Directory></pre> @@ -239,8 +222,7 @@ plain HTTP access for clients on the Intranet.</a></h3> This configuration should remain outside of your HTTPS virtual host, so that it applies to both HTTPS and HTTP.</p> - <pre class="prettyprint lang-config"> -SSLCACertificateFile conf/ssl.crt/company-ca.crt + <pre class="prettyprint lang-config">SSLCACertificateFile conf/ssl.crt/company-ca.crt <Directory /usr/local/apache2/htdocs> # Outside the subarea only Intranet access is granted @@ -277,8 +259,7 @@ SSLCACertificateFile conf/ssl.crt/company-ca.crt AuthBasicProvider file AuthUserFile conf/protected.passwd Require valid-user -</Directory> - </pre> +</Directory></pre> </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> @@ -314,7 +295,7 @@ var comments_identifier = 'http://httpd.apache.org/docs/2.4/ssl/ssl_howto.html'; } })(window, document); //--><!]]></script></div><div id="footer"> -<p class="apache">Copyright 2013 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> +<p class="apache">Copyright 2014 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- if (typeof(prettyPrint) !== 'undefined') { prettyPrint(); |