Apache and SSL
- installing
- multiple SSL virtualhosts on a single IP address
- testing ssl
- ciphers
- dicussion
installing
- > apt-get install libapache-mod-ssl
multiple SSL virtualhosts on a single IP address
Contrary to popular opinion, it is possible to have multiple ssl sites on a single IP. The problem is that apache doesn't know which cert to provide to the client, because it must establish the ssl connection before the client makes a http request in which the domain is specified. Typically, people simply use a different IP address for each ssl site. If this is not an option, it still works to have apache provide a mismatched cert: the client will complain, but usually just once. Or, if you have a *.domain.org cert, then you can host all the subdomains on the same IP without problems (i think older browsers don't support * certs, but most do now).
For example:
Listen 69.90.134.159:443
Listen 69.90.134.159:80
NameVirtualHost 69.90.134.159:443
NameVirtualHost 69.90.134.159:80
SSLCertificateKeyFile /etc/certs/star.revolt.org/key.pem
SSLCertificateFile /etc/certs/star.revolt.org/cert.pem
SSLLogLevel warn
SSLLog /var/log/apache/ssl.log
<VirtualHost 69.90.134.159:443>
ServerName blue.revolt.org
DocumentRoot /var/www/blue
SSLEngine on
</VirtualHost>
<VirtualHost 69.90.134.159:80>
ServerName blue.revolt.org
DocumentRoot /var/www/blue
</VirtualHost>
<VirtualHost 69.90.134.159:443>
ServerName red.revolt.org
DocumentRoot /var/www/red
SSLEngine on
</VirtualHost>
<VirtualHost 69.90.134.159:80>
ServerName red.revolt.org
DocumentRoot /var/www/red
</VirtualHost>
testing ssl
openssl s_client -connect localhost:443 -state -debug
GET / HTTP/1.0
ciphers
There are many possible ciphers you could enable, but some are not very good.
The apache directive to choose the list of available ciphers is HIGH:-SSLv2:-RSA
For example:
SSLCipherSuite HIGH:-SSLv2:-RSA
To see what ciphers this makes available, run the command "openssl ciphers -v". For example:
> openssl ciphers -v HIGH:-SSLv2:-RSA
ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
AECDH-DES-CBC3-SHA SSLv3 Kx=ECDH Au=None Enc=3DES(168) Mac=SHA1
ECDH-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
ECDH-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
ECDH-RSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=RSA Enc=3DES(168) Mac=SHA1
ECDH-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
ECDH-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
ECDH-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=3DES(168) Mac=SHA1
ADH-AES256-SHA SSLv3 Kx=DH Au=None Enc=AES(256) Mac=SHA1
DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1
ADH-AES128-SHA SSLv3 Kx=DH Au=None Enc=AES(128) Mac=SHA1
DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1
ADH-DES-CBC3-SHA SSLv3 Kx=DH Au=None Enc=3DES(168) Mac=SHA1
EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1
EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1
dicussion
HIGH:MEDIUM:-SSLv2:-RSA
- HIGH: a good place to start, we don't want the low ciphers. They suck!
- MEDIUM: 128 bits is still pretty good.
- -SSLv2: there are all kinds of problems with SSLv2.
- -RSA: we disable RSA because of the "perfect forward secrecy problem". This makes it so that aliens can sniff your server, then later steal the key and decrypt what they sniffed.
ALL:!ADH:!SSLv2:!EXP:!LOW:@STRENGTH
- this one seems pretty good too. very similar, but some oddly different ciphers in there.
- @STRENGTH: doesn't seem needed, it orders the ciphers by strength, but that is the default already (perhaps?).
- !ADH: why?
|
