Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:web_c7:apache_2 [28.11.2016 16:18. ] – django | centos:web_c7:apache_2 [02.02.2018 09:39. ] (aktuell) – Löschen von falschen HPKP-Daten beim Browser Firefox django | ||
|---|---|---|---|
| Zeile 263: | Zeile 263: | ||
| ===== Dokumentation ===== | ===== Dokumentation ===== | ||
| ==== Fachliteratur ==== | ==== Fachliteratur ==== | ||
| - | Das Buch **[[https:// | + | <WRAP center round tip 90%> |
| + | Das Buch **[[https:// | ||
| + | |||
| + | Also alles in allem sehr gut angelegte 55€ - das Buch **978-1-907117-04-6** (ISBN) ist in jedem gut sortierten Buchhandel vor Ort erhältlich sein sollte. | ||
| + | </ | ||
| + | |||
| ==== Seiten im WWW ==== | ==== Seiten im WWW ==== | ||
| Zeile 625: | Zeile 630: | ||
| 1.0.1e | 1.0.1e | ||
| </ | </ | ||
| + | |||
| + | ==== Apache.org ==== | ||
| + | Viele wervolle Hinweise zu den Konfigurationsparameter zu **mod_ssl** findet man in der Dokumentation zum [[http:// | ||
| + | |||
| + | |||
| ===== CA Trust ===== | ===== CA Trust ===== | ||
| Dreh- und Angelpunkt bei den CAs und den zugehörigen Root-Zertifikaten ist das Vertrauen, welches man diesen schenken ma und/oder kann. Mit sehr hoher Wahrscheinlichkeit kann man davon ausgehen dass eine CA wie z.B. **[[https:// | Dreh- und Angelpunkt bei den CAs und den zugehörigen Root-Zertifikaten ist das Vertrauen, welches man diesen schenken ma und/oder kann. Mit sehr hoher Wahrscheinlichkeit kann man davon ausgehen dass eine CA wie z.B. **[[https:// | ||
| Zeile 647: | Zeile 657: | ||
| Nutzt man ein kommerzielle CA können wir die nächsten [[centos: | Nutzt man ein kommerzielle CA können wir die nächsten [[centos: | ||
| + | |||
| + | ==== Erstellen einer eigenen CA ==== | ||
| + | === Scriptgesteuert erstellen === | ||
| + | Dem Paket //openssl// liegt zwar ein Bash-Script bei, mit dessen Hilfe die nachfolgenden Installationsschritte automatisiert ablaufen sollen, aber zum besseren Verständnis, | ||
| + | # cat / | ||
| + | <file bash / | ||
| + | # | ||
| + | # CA - wrapper around ca to make it easier to use ... basically ca requires | ||
| + | # some setup stuff to be done before you can use it and this makes | ||
| + | # things easier between now and when Eric is convinced to fix it :-) | ||
| + | # | ||
| + | # CA -newca ... will setup the right stuff | ||
| + | # CA -newreq ... will generate a certificate request | ||
| + | # CA -sign ... will sign the generated request and output | ||
| + | # | ||
| + | # At the end of that grab newreq.pem and newcert.pem (one has the key | ||
| + | # and the other the certificate) and cat them together and that is what | ||
| + | # you want/need ... I'll make even this a little cleaner later. | ||
| + | # | ||
| + | # | ||
| + | # 12-Jan-96 tjh Added more things ... including CA -signcert which | ||
| + | # converts a certificate to a request and then signs it. | ||
| + | # 10-Jan-96 eay Fixed a few more bugs and added the SSLEAY_CONFIG | ||
| + | # environment variable so this can be driven from | ||
| + | # a script. | ||
| + | # 25-Jul-96 eay Cleaned up filenames some more. | ||
| + | # 11-Jun-96 eay Fixed a few filename missmatches. | ||
| + | # 03-May-96 eay Modified to use ' | ||
| + | # 18-Apr-96 tjh Original hacking | ||
| + | # | ||
| + | # Tim Hudson | ||
| + | # tjh@cryptsoft.com | ||
| + | # | ||
| + | |||
| + | # default openssl.cnf file has setup as per the following | ||
| + | # demoCA ... where everything is stored | ||
| + | cp_pem() { | ||
| + | infile=$1 | ||
| + | outfile=$2 | ||
| + | bound=$3 | ||
| + | flag=0 | ||
| + | exec < | ||
| + | while read line; do | ||
| + | if [ $flag -eq 1 ]; then | ||
| + | echo $line|grep " | ||
| + | if [ $? -eq 0 ] ; then | ||
| + | echo $line >> | ||
| + | break | ||
| + | else | ||
| + | echo $line >> | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | echo $line|grep " | ||
| + | if [ $? -eq 0 ]; then | ||
| + | echo $line > | ||
| + | flag=1 | ||
| + | fi | ||
| + | done | ||
| + | } | ||
| + | |||
| + | usage() { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | if [ -z " | ||
| + | |||
| + | if [ -z " | ||
| + | CADAYS=" | ||
| + | REQ=" | ||
| + | CA=" | ||
| + | VERIFY=" | ||
| + | X509=" | ||
| + | PKCS12=" | ||
| + | |||
| + | if [ -z " | ||
| + | CAKEY=./ | ||
| + | CAREQ=./ | ||
| + | CACERT=./ | ||
| + | |||
| + | RET=0 | ||
| + | |||
| + | while [ " | ||
| + | case $1 in | ||
| + | -\? | ||
| + | usage | ||
| + | exit 0 | ||
| + | ;; | ||
| + | -newcert) | ||
| + | # create a certificate | ||
| + | $REQ -new -x509 -keyout newkey.pem -out newcert.pem $DAYS | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -newreq) | ||
| + | # create a certificate request | ||
| + | $REQ -new -keyout newkey.pem -out newreq.pem $DAYS | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -newreq-nodes) | ||
| + | # create a certificate request | ||
| + | $REQ -new -nodes -keyout newreq.pem -out newreq.pem $DAYS | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -newca) | ||
| + | # if explicitly asked for or it doesn' | ||
| + | # structure that Eric likes to manage things | ||
| + | NEW=" | ||
| + | if [ " | ||
| + | # create the directory hierarchy | ||
| + | mkdir -p ${CATOP} | ||
| + | mkdir -p ${CATOP}/ | ||
| + | mkdir -p ${CATOP}/ | ||
| + | mkdir -p ${CATOP}/ | ||
| + | mkdir -p ${CATOP}/ | ||
| + | touch ${CATOP}/ | ||
| + | fi | ||
| + | if [ ! -f ${CATOP}/ | ||
| + | echo "CA certificate filename (or enter to create)" | ||
| + | read FILE | ||
| + | |||
| + | # ask user for existing CA certificate | ||
| + | if [ " | ||
| + | cp_pem $FILE ${CATOP}/ | ||
| + | cp_pem $FILE ${CATOP}/ | ||
| + | RET=$? | ||
| + | if [ ! -f " | ||
| + | $X509 -in ${CATOP}/ | ||
| + | -out ${CATOP}/ | ||
| + | fi | ||
| + | else | ||
| + | echo " | ||
| + | $REQ -new -keyout ${CATOP}/ | ||
| + | -out ${CATOP}/ | ||
| + | $CA -create_serial -out ${CATOP}/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | RET=$? | ||
| + | fi | ||
| + | fi | ||
| + | ;; | ||
| + | -xsign) | ||
| + | $CA -policy policy_anything -infiles newreq.pem | ||
| + | RET=$? | ||
| + | ;; | ||
| + | -pkcs12) | ||
| + | if [ -z " | ||
| + | CNAME=" | ||
| + | else | ||
| + | CNAME=" | ||
| + | fi | ||
| + | $PKCS12 -in newcert.pem -inkey newreq.pem -certfile ${CATOP}/ | ||
| + | -out newcert.p12 -export -name " | ||
| + | RET=$? | ||
| + | exit $RET | ||
| + | ;; | ||
| + | -sign|-signreq) | ||
| + | $CA -policy policy_anything -out newcert.pem -infiles newreq.pem | ||
| + | RET=$? | ||
| + | cat newcert.pem | ||
| + | echo " | ||
| + | ;; | ||
| + | -signCA) | ||
| + | $CA -policy policy_anything -out newcert.pem -extensions v3_ca -infiles newreq.pem | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -signcert) | ||
| + | echo "Cert passphrase will be requested twice - bug?" | ||
| + | $X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem | ||
| + | $CA -policy policy_anything -out newcert.pem -infiles tmp.pem | ||
| + | RET=$? | ||
| + | cat newcert.pem | ||
| + | echo " | ||
| + | ;; | ||
| + | -verify) | ||
| + | shift | ||
| + | if [ -z " | ||
| + | $VERIFY -CAfile $CATOP/ | ||
| + | RET=$? | ||
| + | else | ||
| + | for j | ||
| + | do | ||
| + | $VERIFY -CAfile $CATOP/ | ||
| + | if [ $? != 0 ]; then | ||
| + | RET=$? | ||
| + | fi | ||
| + | done | ||
| + | fi | ||
| + | exit $RET | ||
| + | ;; | ||
| + | *) | ||
| + | echo " | ||
| + | usage | ||
| + | exit 1 | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | exit $RET | ||
| + | </ | ||
| + | <WRAP center round tip> **__Wichtig__**: | ||
| + | Zum besseren Verständnis der Zertifikatsthematik, | ||
| + | |||
| + | === manuelle Erstellung unserer eigenen CA === | ||
| + | == fehlende Dateien anlegen == | ||
| + | Als erstes legen wir die noch fehlenden Dateien an. | ||
| + | # echo " | ||
| + | |||
| + | # touch / | ||
| + | |||
| + | Somit befindet sich in unserem Pfad **/ | ||
| + | # ll /etc/pki/CA | ||
| + | < | ||
| + | drwxr-xr-x 2 root root 6 Jun 24 14:57 certs | ||
| + | drwxr-xr-x 2 root root 6 Jun 24 14:57 crl | ||
| + | -rw-r--r-- 1 root root 0 Jul 23 14:03 index.txt | ||
| + | drwxr-xr-x 2 root root 6 Jun 24 14:57 newcerts | ||
| + | drwx------ 2 root root 6 Jun 24 14:57 private | ||
| + | -rw-r--r-- 1 root root 3 Jul 23 14:03 serial | ||
| + | </ | ||
| + | |||
| + | == CA-Erstellung mit Hilfe von openssl == | ||
| + | Die Gültigkeit setzen wir mit 25 Jahren bewusst sehr hoch an. Nach dem Ablauf der Gültigkeit der CA werden nämlich auch alle damit signierten Serverzertifikate ungültig! Bei der nun folgenden Generierung unserer CA wird automatisch ein Schlüssel (//private key//), mit einer Länge von 2048 Bit, erzeugt und in der Datei **// | ||
| + | |||
| + | Zur Sicherheit schützen wir den //private key// unserer CA mit einer Passphrase! Denn wer den geheimen Schlüssel der CA hat/kennt, könnte damit beliebige Serverzertifikate signieren. Daher legen wir dieses Keyfile nicht im Klartext auf der Festplatte ab, sondern mit einer Passphrase verschlüsselt. Diese Passphrase benötigen wir immer dann, wenn wir mit unser eigenen CA neue Zertifikate ausstellen wollen. Im nachfolgenden Dialog akzetieren wir die Vorgaben in eckigen Klammern, geben unsere individuellen Daten an, oder quittieren ein //leeres Feld// mittels eines **Punktes** **.**. Beim Feld Common Name (CN) geben wir den Domain-Namen unserer Zertifizierungsstelle ein. | ||
| + | |||
| + | Diese Daten werden dem Client angezeigt, sobald dieser aufgefordert wird, das Zertifikat zu akzeptieren oder abzulehnen. | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Die Eingaben sind in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | ..................................................++ | ||
| + | ....................++ | ||
| + | writing new private key to ' | ||
| + | Enter PEM pass phrase: </ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [XX]:</ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Als Ergebnis erhalten wir zwei Dateien: | ||
| + | * **cakey.pem** den //private key// unserer //CA// und | ||
| + | * **cacert.pem** das CA-Certifikat unserer //CA//. | ||
| + | |||
| + | # ll *.pem | ||
| + | |||
| + | < | ||
| + | -rw-r--r-- 1 root root 3406 Aug 29 21:46 cakey.pem | ||
| + | </ | ||
| + | |||
| + | Sichtshalber ändern wir die Rechte so, dass die Schlüsseldateien nur für root lesbar sind: | ||
| + | # chmod 400 *.pem | ||
| + | Bei Bedarf kann man mit **openssl rsa -in < | ||
| + | # openssl rsa -in cakey.pem -noout -text | ||
| + | < | ||
| + | Private-Key: | ||
| + | modulus: | ||
| + | 00: | ||
| + | f5: | ||
| + | 78: | ||
| + | f1: | ||
| + | 4a: | ||
| + | 04: | ||
| + | d8: | ||
| + | d9: | ||
| + | 98: | ||
| + | 67: | ||
| + | 91: | ||
| + | 23: | ||
| + | 8e: | ||
| + | 10: | ||
| + | 46: | ||
| + | f9: | ||
| + | 9d: | ||
| + | 04: | ||
| + | 79: | ||
| + | 21: | ||
| + | dd: | ||
| + | f5: | ||
| + | aa: | ||
| + | 4f: | ||
| + | 22: | ||
| + | fd: | ||
| + | 81: | ||
| + | 4e: | ||
| + | 0c: | ||
| + | 80: | ||
| + | e6: | ||
| + | 4e: | ||
| + | 46: | ||
| + | ce: | ||
| + | f9:25:eb | ||
| + | publicExponent: | ||
| + | privateExponent: | ||
| + | 45: | ||
| + | 7c: | ||
| + | b4: | ||
| + | 5b: | ||
| + | 71: | ||
| + | 59: | ||
| + | 08: | ||
| + | e3: | ||
| + | 5f: | ||
| + | ae: | ||
| + | 65: | ||
| + | 5a: | ||
| + | 84: | ||
| + | e0: | ||
| + | ad: | ||
| + | 3e: | ||
| + | 46: | ||
| + | d9: | ||
| + | 3b: | ||
| + | b5: | ||
| + | bd: | ||
| + | c0: | ||
| + | bc: | ||
| + | f7: | ||
| + | fa: | ||
| + | 1e: | ||
| + | 1c: | ||
| + | b5: | ||
| + | a7: | ||
| + | 3e: | ||
| + | c6: | ||
| + | c4: | ||
| + | 02: | ||
| + | d7: | ||
| + | 6d:a1 | ||
| + | prime1: | ||
| + | 00: | ||
| + | 5b: | ||
| + | 0e: | ||
| + | 02: | ||
| + | 3e: | ||
| + | d0: | ||
| + | 03: | ||
| + | 70: | ||
| + | 3a: | ||
| + | e5: | ||
| + | 8f: | ||
| + | 61: | ||
| + | 12: | ||
| + | cc: | ||
| + | c6: | ||
| + | 2c: | ||
| + | d3: | ||
| + | b6:37 | ||
| + | prime2: | ||
| + | 00: | ||
| + | 15: | ||
| + | d8: | ||
| + | 34: | ||
| + | 73: | ||
| + | f7: | ||
| + | 7e: | ||
| + | ab: | ||
| + | 29: | ||
| + | e4: | ||
| + | 2d: | ||
| + | b6: | ||
| + | 63: | ||
| + | 45: | ||
| + | 06: | ||
| + | 2d: | ||
| + | 44: | ||
| + | b3:ed | ||
| + | exponent1: | ||
| + | 69: | ||
| + | e2: | ||
| + | 64: | ||
| + | ce: | ||
| + | 89: | ||
| + | c5: | ||
| + | b2: | ||
| + | 12: | ||
| + | 36: | ||
| + | 3c: | ||
| + | 09: | ||
| + | a5: | ||
| + | 84: | ||
| + | 76: | ||
| + | aa: | ||
| + | 9b: | ||
| + | f2: | ||
| + | 99 | ||
| + | exponent2: | ||
| + | 0f: | ||
| + | 50: | ||
| + | d8: | ||
| + | 1c: | ||
| + | 3d: | ||
| + | ab: | ||
| + | cd: | ||
| + | 6a: | ||
| + | 1f: | ||
| + | 0e: | ||
| + | d9: | ||
| + | 01: | ||
| + | f5: | ||
| + | f9: | ||
| + | b9: | ||
| + | 82: | ||
| + | 74: | ||
| + | f1 | ||
| + | coefficient: | ||
| + | 00: | ||
| + | 5b: | ||
| + | df: | ||
| + | 72: | ||
| + | 0e: | ||
| + | 76: | ||
| + | 31: | ||
| + | 36: | ||
| + | c3: | ||
| + | 01: | ||
| + | fb: | ||
| + | 03: | ||
| + | 3d: | ||
| + | 46: | ||
| + | b5: | ||
| + | 6a: | ||
| + | 6e: | ||
| + | 82:f5 | ||
| + | </ | ||
| + | |||
| + | Will man die Passphrase eines Schlüssels entfernen, geht man wie folgt vor: | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Auch hier sind die Eingaben sind in der Farbe < | ||
| + | |||
| + | Den Schlüssel unserer eigenen CA verschieben wir nun an die richtige Stelle. | ||
| + | # mv cakey.pem / | ||
| + | |||
| + | Das Gleiche machen wir mit dem eigenen Root-Zertifikat. | ||
| + | # mv cacert.pem / | ||
| + | |||
| + | == Laufzeit der Zertifikate anpassen == | ||
| + | Da wir die Laufzeit der erzeugten Zertifikate nicht auf der Kommandozeile beim Aufruf von **openssl** angeben können, passen wir in der OpenSSL-Konfigurationsdatei die Laufzeit **default_days** an. | ||
| + | |||
| + | # vim / | ||
| + | <file bash / | ||
| + | # OpenSSL example configuration file. | ||
| + | # This is mostly being used for generation of certificate requests. | ||
| + | # | ||
| + | |||
| + | # This definition stops the following lines choking if HOME isn't | ||
| + | # defined. | ||
| + | HOME = . | ||
| + | RANDFILE = $ENV:: | ||
| + | |||
| + | # Extra OBJECT IDENTIFIER info: | ||
| + | # | ||
| + | oid_section = new_oids | ||
| + | |||
| + | # To use this configuration file with the " | ||
| + | # " | ||
| + | # X.509v3 extensions to use: | ||
| + | # extensions = | ||
| + | # (Alternatively, | ||
| + | # X.509v3 extensions in its main [= default] section.) | ||
| + | |||
| + | [ new_oids ] | ||
| + | |||
| + | # We can add new OIDs in here for use by ' | ||
| + | # Add a simple OID like this: | ||
| + | # testoid1=1.2.3.4 | ||
| + | # Or use config file substitution like this: | ||
| + | # testoid2=${testoid1}.5.6 | ||
| + | |||
| + | # Policies used by the TSA examples. | ||
| + | tsa_policy1 = 1.2.3.4.1 | ||
| + | tsa_policy2 = 1.2.3.4.5.6 | ||
| + | tsa_policy3 = 1.2.3.4.5.7 | ||
| + | |||
| + | #################################################################### | ||
| + | [ ca ] | ||
| + | default_ca = CA_default # | ||
| + | |||
| + | #################################################################### | ||
| + | [ CA_default ] | ||
| + | |||
| + | dir = / | ||
| + | certs = $dir/ | ||
| + | crl_dir = $dir/crl # Where the issued crl are kept | ||
| + | database = $dir/ | ||
| + | # | ||
| + | # several ctificates with same subject. | ||
| + | new_certs_dir = $dir/ | ||
| + | |||
| + | certificate = $dir/ | ||
| + | serial = $dir/serial # The current serial number | ||
| + | crlnumber = $dir/ | ||
| + | # must be commented out to leave a V1 CRL | ||
| + | crl = $dir/ | ||
| + | private_key = $dir/ | ||
| + | RANDFILE = $dir/ | ||
| + | |||
| + | x509_extensions = usr_cert # The extentions to add to the cert | ||
| + | |||
| + | # Comment out the following two lines for the " | ||
| + | # (and highly broken) format. | ||
| + | name_opt = ca_default # | ||
| + | cert_opt = ca_default # | ||
| + | |||
| + | # Extension copying option: use with caution. | ||
| + | # copy_extensions = copy | ||
| + | |||
| + | # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs | ||
| + | # so this is commented out by default to leave a V1 CRL. | ||
| + | # crlnumber must also be commented out to leave a V1 CRL. | ||
| + | # crl_extensions = crl_ext | ||
| + | |||
| + | # Django : 2014-07-23 | ||
| + | # default: default_days | ||
| + | default_days = 730 # how long to certify for (two years) | ||
| + | default_crl_days= 30 # how long before next CRL | ||
| + | default_md = sha256 # use SHA-256 by default | ||
| + | preserve = no # keep passed DN ordering | ||
| + | |||
| + | # A few difference way of specifying how similar the request should look | ||
| + | # For type CA, the listed attributes must be the same, and the optional | ||
| + | # and supplied fields are just that :-) | ||
| + | policy = policy_match | ||
| + | |||
| + | # For the CA policy | ||
| + | [ policy_match ] | ||
| + | countryName = match | ||
| + | stateOrProvinceName = match | ||
| + | organizationName = match | ||
| + | organizationalUnitName = optional | ||
| + | commonName = supplied | ||
| + | emailAddress = optional | ||
| + | |||
| + | # For the ' | ||
| + | # At this point in time, you must list all acceptable ' | ||
| + | # types. | ||
| + | [ policy_anything ] | ||
| + | countryName = optional | ||
| + | stateOrProvinceName = optional | ||
| + | localityName = optional | ||
| + | organizationName = optional | ||
| + | organizationalUnitName = optional | ||
| + | commonName = supplied | ||
| + | emailAddress = optional | ||
| + | |||
| + | #################################################################### | ||
| + | [ req ] | ||
| + | default_bits = 2048 | ||
| + | default_md = sha256 | ||
| + | default_keyfile = privkey.pem | ||
| + | distinguished_name = req_distinguished_name | ||
| + | attributes = req_attributes | ||
| + | x509_extensions = v3_ca # The extentions to add to the self signed cert | ||
| + | |||
| + | # Passwords for private keys if not present they will be prompted for | ||
| + | # input_password = secret | ||
| + | # output_password = secret | ||
| + | |||
| + | # This sets a mask for permitted string types. There are several options. | ||
| + | # default: PrintableString, | ||
| + | # pkix : PrintableString, | ||
| + | # utf8only: only UTF8Strings (PKIX recommendation after 2004). | ||
| + | # nombstr : PrintableString, | ||
| + | # MASK:XXXX a literal mask value. | ||
| + | # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. | ||
| + | string_mask = utf8only | ||
| + | |||
| + | # req_extensions = v3_req # The extensions to add to a certificate request | ||
| + | |||
| + | [ req_distinguished_name ] | ||
| + | countryName = Country Name (2 letter code) | ||
| + | countryName_default = XX | ||
| + | countryName_min = 2 | ||
| + | countryName_max = 2 | ||
| + | |||
| + | stateOrProvinceName = State or Province Name (full name) | ||
| + | # | ||
| + | |||
| + | localityName = Locality Name (eg, city) | ||
| + | localityName_default = Default City | ||
| + | |||
| + | 0.organizationName = Organization Name (eg, company) | ||
| + | 0.organizationName_default = Default Company Ltd | ||
| + | |||
| + | # we can do this but it is not needed normally :-) | ||
| + | # | ||
| + | # | ||
| + | |||
| + | organizationalUnitName = Organizational Unit Name (eg, section) | ||
| + | # | ||
| + | |||
| + | commonName = Common Name (eg, your name or your server\' | ||
| + | commonName_max = 64 | ||
| + | |||
| + | emailAddress = Email Address | ||
| + | emailAddress_max = 64 | ||
| + | |||
| + | # SET-ex3 = SET extension number 3 | ||
| + | |||
| + | [ req_attributes ] | ||
| + | challengePassword = A challenge password | ||
| + | challengePassword_min = 4 | ||
| + | challengePassword_max = 20 | ||
| + | |||
| + | unstructuredName = An optional company name | ||
| + | |||
| + | [ usr_cert ] | ||
| + | |||
| + | # These extensions are added when ' | ||
| + | |||
| + | # This goes against PKIX guidelines but some CAs do it and some software | ||
| + | # requires this to avoid interpreting an end user certificate as a CA. | ||
| + | |||
| + | basicConstraints=CA: | ||
| + | |||
| + | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| + | # the certificate can be used for anything *except* object signing. | ||
| + | |||
| + | # This is OK for an SSL server. | ||
| + | # nsCertType = server | ||
| + | |||
| + | # For an object signing certificate this would be used. | ||
| + | # nsCertType = objsign | ||
| + | |||
| + | # For normal client use this is typical | ||
| + | # nsCertType = client, email | ||
| + | |||
| + | # and for everything including object signing: | ||
| + | # nsCertType = client, email, objsign | ||
| + | |||
| + | # This is typical in keyUsage for a client certificate. | ||
| + | # keyUsage = nonRepudiation, | ||
| + | |||
| + | # This will be displayed in Netscape' | ||
| + | nsComment = " | ||
| + | |||
| + | # PKIX recommendations harmless if included in all certificates. | ||
| + | subjectKeyIdentifier=hash | ||
| + | authorityKeyIdentifier=keyid, | ||
| + | |||
| + | # This stuff is for subjectAltName and issuerAltname. | ||
| + | # Import the email address. | ||
| + | # subjectAltName=email: | ||
| + | # An alternative to produce certificates that aren't | ||
| + | # deprecated according to PKIX. | ||
| + | # subjectAltName=email: | ||
| + | |||
| + | # Copy subject details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # | ||
| + | #nsBaseUrl | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # This is required for TSA certificates. | ||
| + | # extendedKeyUsage = critical, | ||
| + | |||
| + | [ v3_req ] | ||
| + | |||
| + | # Extensions to add to a certificate request | ||
| + | |||
| + | basicConstraints = CA:FALSE | ||
| + | keyUsage = nonRepudiation, | ||
| + | |||
| + | [ v3_ca ] | ||
| + | |||
| + | |||
| + | # Extensions for a typical CA | ||
| + | |||
| + | |||
| + | # PKIX recommendation. | ||
| + | |||
| + | subjectKeyIdentifier=hash | ||
| + | |||
| + | authorityKeyIdentifier=keyid: | ||
| + | |||
| + | # This is what PKIX recommends but some broken software chokes on critical | ||
| + | # extensions. | ||
| + | # | ||
| + | # So we do this instead. | ||
| + | basicConstraints = CA:true | ||
| + | |||
| + | # Key usage: this is typical for a CA certificate. However since it will | ||
| + | # prevent it being used as an test self-signed certificate it is best | ||
| + | # left out by default. | ||
| + | # keyUsage = cRLSign, keyCertSign | ||
| + | |||
| + | # Some might want this also | ||
| + | # nsCertType = sslCA, emailCA | ||
| + | |||
| + | # Include email address in subject alt name: another PKIX recommendation | ||
| + | # subjectAltName=email: | ||
| + | # Copy issuer details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # DER hex encoding of an extension: beware experts only! | ||
| + | # obj=DER: | ||
| + | # Where ' | ||
| + | # You can even override a supported extension: | ||
| + | # basicConstraints= critical, DER: | ||
| + | |||
| + | [ crl_ext ] | ||
| + | |||
| + | # CRL extensions. | ||
| + | # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. | ||
| + | |||
| + | # issuerAltName=issuer: | ||
| + | authorityKeyIdentifier=keyid: | ||
| + | |||
| + | [ proxy_cert_ext ] | ||
| + | # These extensions should be added when creating a proxy certificate | ||
| + | |||
| + | # This goes against PKIX guidelines but some CAs do it and some software | ||
| + | # requires this to avoid interpreting an end user certificate as a CA. | ||
| + | |||
| + | basicConstraints=CA: | ||
| + | |||
| + | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| + | # the certificate can be used for anything *except* object signing. | ||
| + | |||
| + | # This is OK for an SSL server. | ||
| + | # nsCertType = server | ||
| + | |||
| + | # For an object signing certificate this would be used. | ||
| + | # nsCertType = objsign | ||
| + | |||
| + | # For normal client use this is typical | ||
| + | # nsCertType = client, email | ||
| + | |||
| + | # and for everything including object signing: | ||
| + | # nsCertType = client, email, objsign | ||
| + | |||
| + | # This is typical in keyUsage for a client certificate. | ||
| + | # keyUsage = nonRepudiation, | ||
| + | |||
| + | # This will be displayed in Netscape' | ||
| + | nsComment = " | ||
| + | |||
| + | # PKIX recommendations harmless if included in all certificates. | ||
| + | subjectKeyIdentifier=hash | ||
| + | authorityKeyIdentifier=keyid, | ||
| + | |||
| + | # This stuff is for subjectAltName and issuerAltname. | ||
| + | # Import the email address. | ||
| + | # subjectAltName=email: | ||
| + | # An alternative to produce certificates that aren't | ||
| + | # deprecated according to PKIX. | ||
| + | # subjectAltName=email: | ||
| + | |||
| + | # Copy subject details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # | ||
| + | #nsBaseUrl | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # This really needs to be in place for it to be a proxy certificate. | ||
| + | proxyCertInfo=critical, | ||
| + | |||
| + | #################################################################### | ||
| + | [ tsa ] | ||
| + | |||
| + | default_tsa = tsa_config1 # | ||
| + | |||
| + | [ tsa_config1 ] | ||
| + | |||
| + | # These are used by the TSA reply generation only. | ||
| + | dir = ./demoCA # TSA root directory | ||
| + | serial = $dir/ | ||
| + | crypto_device = builtin # OpenSSL engine to use for signing | ||
| + | signer_cert = $dir/ | ||
| + | # (optional) | ||
| + | certs = $dir/ | ||
| + | # (optional) | ||
| + | signer_key = $dir/ | ||
| + | |||
| + | default_policy = tsa_policy1 # | ||
| + | # (optional) | ||
| + | other_policies = tsa_policy2, | ||
| + | digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) | ||
| + | accuracy = secs:1, millisecs: | ||
| + | clock_precision_digits | ||
| + | ordering = yes # Is ordering defined for timestamps? | ||
| + | # (optional, default: no) | ||
| + | tsa_name = yes # Must the TSA name be included in the reply? | ||
| + | # (optional, default: no) | ||
| + | ess_cert_id_chain = no # Must the ESS cert id chain be included? | ||
| + | # (optional, default: no) | ||
| + | </ | ||
| + | |||
| + | ==== Schlüssel für das Serverzertifikat erzeugen ==== | ||
| + | Nachdem wir nun unsere eigene CA erstellt haben, machen wir uns daran, endlich für unseren Server ein Zertifikat herauszugeben. Hierzu erzeugen wir als erstes einen 4096 Bit langen RSA Schlüssel, den wir mit AES 256 verschlüsselt auf der Platte abgelegt lassen. Da OpenSSL keine leere Passphrase zulässt braucht die Passphrase diesmal nicht sonderlich geheim sein, da wir diese im Anschluss ohnehin sofort wieder entfernen werden. | ||
| + | |||
| + | Die Eingaben sind in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | .......................................................................................................................................................................................................................++ | ||
| + | ........................................................................................................................................................................................++ | ||
| + | e is 65537 (0x10001) | ||
| + | Enter pass phrase for serverkey.pem: | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Wie schon erwähnt, entfernen wir die Passphrase nun wieder, in dem wir bei der Frage **Enter pass phrase:** einfach die Taste **[ENTER]** drücken. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | writing RSA key</ | ||
| + | </ | ||
| + | |||
| + | Wie schon zuvor schützen wir auch hier den Serverschlüssel über die Dateirechte, | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | ==== Certificate Signing Request erzeugen ==== | ||
| + | Im folgenden Schritt zu unserem eigenen Zertifikat erzeugen wir einen **CSR**((**C**ertificate **S**igning **R**equest)), | ||
| + | |||
| + | <WRAP round alert> **__Wichtig__**: | ||
| + | |||
| + | Auch hier sind die Eingaben in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [XX]:</ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | Please enter the following ' | ||
| + | to be sent with your certificate request | ||
| + | A challenge password []: | ||
| + | An optional company name []:</ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round info> | ||
| + | Wollen oder müssen wir ein kommerzielles Zertifikat, also von einer in den Browsern und mailclients von Haus aus installierten CAs, nutzen, so lassen wir den CSR der CA zukommen. | ||
| + | # cat csr.pem | ||
| + | < | ||
| + | MIIE5TCCAs0CAQAwgZ8xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xETAP | ||
| + | BgNVBAcMCFBsaWVuaW5nMRMwEQYDVQQKDApuYXVzY2gub3JnMRMwEQYDVQQLDApX | ||
| + | RUItT2ZmaWNlMRowGAYDVQQDDBF3d3cuc2VjLW1haWwuZ3VydTEmMCQGCSqGSIb3 | ||
| + | DQEJARYXd2VibWFzdGVyQHNlYy1tYWlsLmd1cnUwggIiMA0GCSqGSIb3DQEBAQUA | ||
| + | A4ICDwAwggIKAoICAQCvfVsj0y+ZEbP1zlQX6z+vXXvfQXNfTqKnL97F08Yho423 | ||
| + | odUteIcaJGqtUpzmhSGmw+0Z7oyVAUiLuZtsChXk// | ||
| + | GTxclb2cgYVPaEg17OlwYaNAew5Zxv7GYHISgBsr1MRSdJ6lo6lrGxrbDl3fXYrj | ||
| + | TlDZtd9xMIEJ4zh9CuOofNlF0PF2bP/ | ||
| + | suomiXtk9oojy4+7qqxKJrHB9MV/ | ||
| + | 6urf7KVhoDO121U+5c/ | ||
| + | QlBQ6Hq4e5D0712DlHTsNQPVDzZCMNzwwDg0lZrr0WLjnYl2MHRiJnUpjpIaYYVB | ||
| + | hGeb9ZTItpqvRBMjmycW1NMFszZNYD0no8fPvxXn7UyIRRs7jP8rSGwBI5srMXfo | ||
| + | jLiJ6aaUlE3ajXQI9x02OrYbAN96zgb+pI29/ | ||
| + | GpbSwFSPfakhMBDNce+8/ | ||
| + | 1KXnVMv8jEZQXuAqkXFV708/ | ||
| + | AQABoAAwDQYJKoZIhvcNAQELBQADggIBAIdzPh2e5A9FMgRh3ZCugZDZ1/ | ||
| + | 9V1shTO9tpGt1SGv4i5jNKWUaPdQrj8OOW8tV29cBKK74gbZNs6iQMHF68TodeLc | ||
| + | nJCDN/ | ||
| + | kvRhW/ | ||
| + | 4UglboPOBZBvofttN++9v7RNkFCbcAJU+JR738oqSuNgjn6w9IQhPmSjyazY6ZF5 | ||
| + | UdEGnnCnpR/ | ||
| + | HB+K7cR/ | ||
| + | fZZZucmY2bHONtl6q/ | ||
| + | f4MKgqUytka+ga/ | ||
| + | JyoCweVtz3BCh0mOVU7x2RDqGNtrOopwqKtbA+3SpDQmXFPLvYO38Hspa0712QJh | ||
| + | 9Zos5rF0ta/ | ||
| + | U56QhSgOCblB | ||
| + | -----END CERTIFICATE REQUEST----- | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Bei Interesse können wir uns unseren **CSR** auch ansehen, dazu benutzen wir folgenden Befehl: | ||
| + | # openssl req -noout -text -in csr.pem | ||
| + | < | ||
| + | Data: | ||
| + | Version: 0 (0x0) | ||
| + | Subject: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | 3f: | ||
| + | c6: | ||
| + | 9c: | ||
| + | 9b: | ||
| + | c4: | ||
| + | 85: | ||
| + | fe: | ||
| + | a9: | ||
| + | df: | ||
| + | f1: | ||
| + | 38: | ||
| + | ea: | ||
| + | b1: | ||
| + | 26: | ||
| + | 45: | ||
| + | cf: | ||
| + | a8: | ||
| + | e9: | ||
| + | 5d: | ||
| + | 38: | ||
| + | 75: | ||
| + | 9a: | ||
| + | 3d: | ||
| + | ff: | ||
| + | a6: | ||
| + | df: | ||
| + | dd: | ||
| + | 96: | ||
| + | 0d: | ||
| + | 46: | ||
| + | 01: | ||
| + | 71: | ||
| + | d4: | ||
| + | 0a:28:4b | ||
| + | Exponent: 65537 (0x10001) | ||
| + | Attributes: | ||
| + | a0:00 | ||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | </ | ||
| + | |||
| + | ==== eigene CA: CSR beabeiten - Zertifikat erstellen ==== | ||
| + | Kommen wir zum krönenden Abschluss - wir signieren nun das Server-Zertifikat durch unsere CA, oder anders ausgedrückt, | ||
| + | |||
| + | Wie schon bereits bei den anderen Konfigurationsbeispielen, | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | Enter pass phrase for / | ||
| + | <font style=" | ||
| + | Enter pass phrase for / | ||
| + | Check that the request matches the signature | ||
| + | Signature ok | ||
| + | Certificate Details: | ||
| + | Serial Number: 0 (0x0) | ||
| + | Validity | ||
| + | Not Before: Aug 29 21:44:44 2014 GMT | ||
| + | Not After : Aug 28 21:44:44 2016 GMT | ||
| + | Subject: | ||
| + | countryName | ||
| + | stateOrProvinceName | ||
| + | organizationName | ||
| + | organizationalUnitName | ||
| + | commonName | ||
| + | emailAddress | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 88: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Certificate is to be certified until Aug 28 21:44:44 2016 GMT (730 days) | ||
| + | Sign the certificate? | ||
| + | <font style=" | ||
| + | |||
| + | 1 out of 1 certificate requests certified, commit? [y/ | ||
| + | <font style=" | ||
| + | Data Base Updated</ | ||
| + | </ | ||
| + | |||
| + | In unserem Arbeitsverzeichnis finden wir nun auch das Serverzertifikat **servercert.pem**. | ||
| + | |||
| + | Auch hier können wir uns mit hilfe von **openssl** das Zertifikat genauer ansehen. | ||
| + | # openssl x509 -noout -text -in servercert.pem | ||
| + | < | ||
| + | Data: | ||
| + | Version: 3 (0x2) | ||
| + | Serial Number: 0 (0x0) | ||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | Issuer: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Validity | ||
| + | Not Before: Aug 29 21:44:44 2014 GMT | ||
| + | Not After : Aug 28 21:44:44 2016 GMT | ||
| + | Subject: C=DE, ST=Bayern, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | 3f: | ||
| + | c6: | ||
| + | 9c: | ||
| + | 9b: | ||
| + | c4: | ||
| + | 85: | ||
| + | fe: | ||
| + | a9: | ||
| + | df: | ||
| + | f1: | ||
| + | 38: | ||
| + | ea: | ||
| + | b1: | ||
| + | 26: | ||
| + | 45: | ||
| + | cf: | ||
| + | a8: | ||
| + | e9: | ||
| + | 5d: | ||
| + | 38: | ||
| + | 75: | ||
| + | 9a: | ||
| + | 3d: | ||
| + | ff: | ||
| + | a6: | ||
| + | df: | ||
| + | dd: | ||
| + | 96: | ||
| + | 0d: | ||
| + | 46: | ||
| + | 01: | ||
| + | 71: | ||
| + | d4: | ||
| + | 0a:28:4b | ||
| + | Exponent: 65537 (0x10001) | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 88: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | </ | ||
| + | |||
| + | ==== Speicherort ==== | ||
| + | Bei der Installation der **openssl-libs** wurden bereits die Unterordner für das WEB-Server-Zertifikat und der zugehörigen Schlüssel-Datei unter **/ | ||
| + | < | ||
| + | ├── cert.pem -> / | ||
| + | ├── certs | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | ├── misc | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | │ | ||
| + | ├── openssl.cnf | ||
| + | └── private | ||
| + | └── localhost.key | ||
| + | </ | ||
| + | |||
| + | Anschließend legen wir dort die drei benötigten Dateien ab: | ||
| + | - unseren // | ||
| + | - unseren // | ||
| + | - das // | ||
| + | - und schützen diese Dateien mit den Dateirechten **400**: < | ||
| + | # chmod 400 / | ||
| + | |||
| + | ===== Konfiguration ===== | ||
| + | ==== ssl.conf ==== | ||
| + | Bei der Konfiguration unseres TLS-gesicherten Apache-Webservers benutzen wir nun nicht die (komplette) mitgelieferte Konfigurationsdatei // | ||
| + | |||
| + | Wir sichern dazu erst einmal die originale Konfigurationsdatei. | ||
| + | # cp -a / | ||
| + | |||
| + | Im ersten Schritt werden wir nun bestehende Konfigurationsdatei soweit " | ||
| + | |||
| + | # vim / | ||
| + | <file bash / | ||
| + | # When we also provide SSL we have to listen to the | ||
| + | # the HTTPS port in addition. | ||
| + | # | ||
| + | Listen 443 https | ||
| + | |||
| + | ## | ||
| + | ## SSL Global Context | ||
| + | ## | ||
| + | ## All SSL configuration in this context applies both to | ||
| + | ## the main server and all SSL-enabled virtual hosts. | ||
| + | ## | ||
| + | |||
| + | # Pass Phrase Dialog: | ||
| + | # | ||
| + | # The filtering dialog program (`builtin' | ||
| + | # | ||
| + | SSLPassPhraseDialog exec:/ | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # to use and second the expiring timeout (in seconds). | ||
| + | SSLSessionCache | ||
| + | SSLSessionCacheTimeout | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # SSL library. The seed data should be of good random quality. | ||
| + | # | ||
| + | # is available. This means you then cannot use the /dev/random device | ||
| + | # | ||
| + | # it requires to make more entropy available). But usually those | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | SSLRandomSeed startup file:/ | ||
| + | SSLRandomSeed connect builtin | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # Use " | ||
| + | # accelerators. Use " | ||
| + | # engine names. | ||
| + | # server does not start, consult the error logs and ensure | ||
| + | # your accelerator is functioning properly. | ||
| + | # | ||
| + | SSLCryptoDevice builtin | ||
| + | # | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## SSL Virtual Host Context | ||
| + | ## | ||
| + | |||
| + | #< | ||
| + | # | ||
| + | ## General setup for the virtual host, inherited from global configuration | ||
| + | ## | ||
| + | ## | ||
| + | # | ||
| + | ## Use separate log files for the SSL virtual host; note that LogLevel | ||
| + | ## is not inherited from httpd.conf. | ||
| + | #ErrorLog logs/ | ||
| + | # | ||
| + | #LogLevel warn | ||
| + | # | ||
| + | ## SSL Engine Switch: | ||
| + | ## | ||
| + | #SSLEngine on | ||
| + | # | ||
| + | ## SSL Protocol support: | ||
| + | ## List the enable protocol levels with which clients will be able to | ||
| + | ## connect. | ||
| + | # | ||
| + | # | ||
| + | ## SSL Cipher Suite: | ||
| + | ## List the ciphers that the client is permitted to negotiate. | ||
| + | ## See the mod_ssl documentation for a complete list. | ||
| + | # | ||
| + | # | ||
| + | ## | ||
| + | ## If speed is your main concern (on busy HTTPS servers e.g.), | ||
| + | ## you might want to force clients to specific, performance | ||
| + | ## | ||
| + | ## to the SSLCipherSuite list, and enable SSLHonorCipherOrder. | ||
| + | ## | ||
| + | ## (as in the example below), most connections will no longer | ||
| + | ## have perfect forward secrecy - if the server' | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | # | ||
| + | ## | ||
| + | ## Point SSLCertificateFile at a PEM encoded certificate. | ||
| + | ## the certificate is encrypted, then you will be prompted for a | ||
| + | ## pass phrase. | ||
| + | ## certificate can be generated using the genkey(1) command. | ||
| + | # | ||
| + | # | ||
| + | ## | ||
| + | ## If the key is not combined with the certificate, | ||
| + | ## | ||
| + | ## | ||
| + | ## both in parallel (to also allow the use of DSA ciphers, etc.) | ||
| + | # | ||
| + | # | ||
| + | ## | ||
| + | ## Point SSLCertificateChainFile at a file containing the | ||
| + | ## | ||
| + | ## | ||
| + | ## the referenced file can be the same as SSLCertificateFile | ||
| + | ## when the CA certificates are directly appended to the server | ||
| + | ## | ||
| + | ## | ||
| + | # | ||
| + | ## | ||
| + | ## Set the CA certificate verification path where to find CA | ||
| + | ## | ||
| + | ## huge file containing all of them (file must be PEM encoded) | ||
| + | ## | ||
| + | # | ||
| + | ## | ||
| + | ## | ||
| + | ## none, optional, require and optional_no_ca. | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | # | ||
| + | ## | ||
| + | ## With SSLRequire you can do per-directory access control based | ||
| + | ## on arbitrary complex boolean expressions containing server | ||
| + | ## | ||
| + | ## | ||
| + | ## for more details. | ||
| + | ##< | ||
| + | ## | ||
| + | ## and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ | ||
| + | ## and %{SSL_CLIENT_S_DN_OU} in {" | ||
| + | ## and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ | ||
| + | ## and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ | ||
| + | ## or %{REMOTE_ADDR} =~ m/ | ||
| + | ##</ | ||
| + | # | ||
| + | ## SSL Engine Options: | ||
| + | ## Set various options for the SSL engine. | ||
| + | ## o FakeBasicAuth: | ||
| + | ## | ||
| + | ## the standard Auth/ | ||
| + | ## user name is the `one line' version of the client' | ||
| + | ## Note that no password is obtained from the user. Every entry in the user | ||
| + | ## file needs this password: `xxj31ZMTZzkVA' | ||
| + | ## o ExportCertData: | ||
| + | ## This exports two additional environment variables: SSL_CLIENT_CERT and | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | ## into CGI scripts. | ||
| + | ## o StdEnvVars: | ||
| + | ## This exports the standard SSL/TLS related `SSL_*' | ||
| + | ## Per default this exportation is switched off for performance reasons, | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | ## o StrictRequire: | ||
| + | ## This denies access when " | ||
| + | ## under a " | ||
| + | ## and no other module can change it. | ||
| + | ## o OptRenegotiate: | ||
| + | ## This enables optimized SSL connection renegotiation handling when SSL | ||
| + | ## | ||
| + | ## | ||
| + | #<Files ~ " | ||
| + | # SSLOptions +StdEnvVars | ||
| + | #</ | ||
| + | #< | ||
| + | # SSLOptions +StdEnvVars | ||
| + | #</ | ||
| + | # | ||
| + | ## SSL Protocol Adjustments: | ||
| + | ## The safe and default but still SSL/TLS standard compliant shutdown | ||
| + | ## | ||
| + | ## the close notify alert from client. When you need a different shutdown | ||
| + | ## | ||
| + | ## o ssl-unclean-shutdown: | ||
| + | ## This forces an unclean shutdown when the connection is closed, i.e. no | ||
| + | ## SSL close notify alert is send or allowed to received. | ||
| + | ## the SSL/TLS standard but is needed for some brain-dead browsers. Use | ||
| + | ## this when you receive I/O errors because of the standard approach where | ||
| + | ## | ||
| + | ## o ssl-accurate-shutdown: | ||
| + | ## This forces an accurate shutdown when the connection is closed, i.e. a | ||
| + | ## SSL close notify alert is send and mod_ssl waits for the close notify | ||
| + | ## alert of the client. This is 100% SSL/TLS standard compliant, but in | ||
| + | ## | ||
| + | ## this only for browsers where you know that their SSL implementation | ||
| + | ## works correctly. | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | ## their broken HTTP/1.1 implementation. Use variables " | ||
| + | ## " | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | ## | ||
| + | ## The home of a custom SSL log file. Use this when you want a | ||
| + | ## | ||
| + | #CustomLog logs/ | ||
| + | # "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \" | ||
| + | # | ||
| + | #</ | ||
| + | </ | ||
| + | |||
| + | Die Hauptkonfiguration beschrängt sich demnach auf folgende sieben Zeilen: | ||
| + | # egrep -v ' | ||
| + | |||
| + | <code bash> | ||
| + | SSLPassPhraseDialog exec:/ | ||
| + | SSLSessionCache | ||
| + | SSLSessionCacheTimeout | ||
| + | SSLRandomSeed startup file:/ | ||
| + | SSLRandomSeed connect builtin | ||
| + | SSLCryptoDevice builtin</ | ||
| + | |||
| + | |||
| + | ==== vHost.conf ==== | ||
| + | |||
| + | # vim / | ||
| + | <file apache / | ||
| + | # Django : 2015-10-30 | ||
| + | # vHost hk-forum | ||
| + | # | ||
| + | |||
| + | # Variablen der Hostvariablen | ||
| + | Define vhost hk-forum | ||
| + | Define errors_log logs/ | ||
| + | Define access_log logs/ | ||
| + | Define ssl_log logs/ | ||
| + | |||
| + | < | ||
| + | ServerAdmin webmaster@nausch.org | ||
| + | ServerName ${vhost}.nausch.org | ||
| + | |||
| + | RewriteEngine on | ||
| + | RewriteCond %{HTTPS} off | ||
| + | RewriteRule (.*) https:// | ||
| + | |||
| + | # Welche Logdateien sollen beschrieben werden | ||
| + | SetEnvIf Remote_Addr " | ||
| + | ErrorLog | ||
| + | CustomLog ${access_log} combined env=!dontlog | ||
| + | </ | ||
| + | < | ||
| + | ServerAdmin webmaster@nausch.org | ||
| + | ServerName ${vhost}.nausch.org | ||
| + | ServerPath / | ||
| + | |||
| + | # Wer soll Zugriff auf die Webseite(n) bekommen? | ||
| + | #< | ||
| + | # Options +FollowSymLinks +Multiviews -Indexes | ||
| + | # AllowOverride None | ||
| + | # AuthType Basic | ||
| + | # AuthName "Fuer den Zugriff auf den Webserver bitte Anmeldedaten eingeben!" | ||
| + | # AuthBasicProvider ldap | ||
| + | # AuthLDAPUrl ldaps:// | ||
| + | # AuthLDAPBindDN cn=Technischeruser, | ||
| + | # AuthLDAPBindPassword " | ||
| + | # AuthLDAPBindAuthoritative on | ||
| + | # Require ldap-user accessuser | ||
| + | #</ | ||
| + | |||
| + | # Welcher Inhalt soll angezeigt bzw. auf welchen Server sollen die HTTP-Requests | ||
| + | # | ||
| + | DocumentRoot | ||
| + | DirectoryIndex index.php | ||
| + | |||
| + | < | ||
| + | Options none | ||
| + | AllowOverride Limit | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | Require all denied | ||
| + | </ | ||
| + | |||
| + | # Welche Logdateien sollen beschrieben werden | ||
| + | SetEnvIf Remote_Addr " | ||
| + | ErrorLog | ||
| + | CustomLog ${access_log} combined env=!dontlog | ||
| + | CustomLog ${ssl_log} "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \" | ||
| + | |||
| + | # Absicherung der Übertragung mit Hilfe von TLS | ||
| + | # Django : 2015-10-04 - TLS-Verschlüsselung mit Hilfe von mod_ssl | ||
| + | SSLEngine on | ||
| + | # Definition der anzubietenden Protokolle | ||
| + | SSLProtocol All -SSLv2 -SSLv3 | ||
| + | # Definition der Cipher | ||
| + | SSLCipherSuite " | ||
| + | # Schlüsseldatei, | ||
| + | SSLCertificateKeyFile / | ||
| + | # Zertifikatsdatei , die von der CA signiert wurde | ||
| + | SSLCertificateFile / | ||
| + | # Zertifikatsdatei des bzw. der Intermediate-Zertifikate(s) | ||
| + | SSLCertificateChainFile / | ||
| + | # Änderung der Cipherorder der Clienets verneinen | ||
| + | SSLHonorCipherOrder on | ||
| + | # TLS 1.0 Kompremmierung deaktivieren (CRIME attacks) | ||
| + | SSLCompression off | ||
| + | # Online Certificate Status Protocol stapling zum Prüfen des | ||
| + | # Gültigkeitsstatus des Serverzertifikats. | ||
| + | SSLUseStapling | ||
| + | SSLStaplingResponderTimeout 5 | ||
| + | SSLStaplingReturnResponderErrors off | ||
| + | # ist in der ssl.conf | ||
| + | # SSLStaplingCache | ||
| + | |||
| + | # special stuff ### | ||
| + | |||
| + | # HTTP Strict Transport Security (HSTS), bei dem der Server dem Client im HTTP-Header | ||
| + | # mitteilt, dass dieser nur noch verschlüsselt mit dem Server kommunizieren soll. | ||
| + | Header always set Strict-Transport-Security " | ||
| + | |||
| + | # This header enables the Cross-site scripting (XSS) filter built into most recent | ||
| + | # web browsers. It's usually enabled by default anyway, so the role of this header | ||
| + | # is to re-enable the filter for this particular website if it was disabled by the | ||
| + | # user. https:// | ||
| + | Header set X-XSS-Protection "1; mode=block" | ||
| + | |||
| + | # when serving user-supplied content, include a X-Content-Type-Options: | ||
| + | # header along with the Content-Type: | ||
| + | # some browsers. https:// | ||
| + | # currently suppoorted in IE > 8 | ||
| + | # http:// | ||
| + | # http:// | ||
| + | # ' | ||
| + | Header set X-Content-Type-Options nosniff | ||
| + | |||
| + | # config to don't allow the browser to render the page inside an frame or iframe | ||
| + | # and avoid clickjacking http:// | ||
| + | # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with | ||
| + | # ALLOW-FROM uri https:// | ||
| + | header set X-Frame-Options DENY | ||
| + | |||
| + | # hide server header (apache and php version) | ||
| + | Header unset Server | ||
| + | |||
| + | # Only allow JavaScript from the same domain to be run. | ||
| + | # don't allow inline JavaScript to run. | ||
| + | Header set X-Content-Security-Policy "allow ' | ||
| + | |||
| + | # Add Secure and HTTP only attributes to cookies | ||
| + | Header edit Set-Cookie ^(.*)$ $1; | ||
| + | |||
| + | # prevent Clickjacking Attack | ||
| + | #Header always append X-Frame-Options SAMEORIGIN | ||
| + | Header set Content-Security-Policy " | ||
| + | </ | ||
| + | |||
| + | |||
| + | </ | ||
| + | FIXME | ||
| + | |||
| + | # vim / | ||
| + | <file apache / | ||
| + | # When we also provide SSL we have to listen to the | ||
| + | # the HTTPS port in addition. | ||
| + | # | ||
| + | Listen 443 https | ||
| + | |||
| + | ## | ||
| + | ## SSL Global Context | ||
| + | ## | ||
| + | ## All SSL configuration in this context applies both to | ||
| + | ## the main server and all SSL-enabled virtual hosts. | ||
| + | ## | ||
| + | |||
| + | # Pass Phrase Dialog: | ||
| + | # | ||
| + | # The filtering dialog program (`builtin' | ||
| + | # | ||
| + | SSLPassPhraseDialog exec:/ | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # to use and second the expiring timeout (in seconds). | ||
| + | SSLSessionCache | ||
| + | SSLSessionCacheTimeout | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # SSL library. The seed data should be of good random quality. | ||
| + | # | ||
| + | # is available. This means you then cannot use the /dev/random device | ||
| + | # | ||
| + | # it requires to make more entropy available). But usually those | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | SSLRandomSeed startup file:/ | ||
| + | SSLRandomSeed connect builtin | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # Use " | ||
| + | # accelerators. Use " | ||
| + | # engine names. | ||
| + | # server does not start, consult the error logs and ensure | ||
| + | # your accelerator is functioning properly. | ||
| + | # | ||
| + | SSLCryptoDevice builtin | ||
| + | # | ||
| + | |||
| + | ## | ||
| + | ## SSL Virtual Host Context | ||
| + | ## | ||
| + | |||
| + | < | ||
| + | |||
| + | # General setup for the virtual host, inherited from global configuration | ||
| + | # | ||
| + | #ServerName www.example.com: | ||
| + | |||
| + | ServerAdmin webmaster@sec-mail.guru | ||
| + | ServerName www.sec-mail.guru | ||
| + | ServerPath / | ||
| + | DocumentRoot "/ | ||
| + | |||
| + | < | ||
| + | Options FollowSymLinks | ||
| + | AllowOverride none | ||
| + | Order allow,deny | ||
| + | Allow from All | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | Order allow,deny | ||
| + | Deny from all | ||
| + | Satisfy All | ||
| + | </ | ||
| + | |||
| + | DirectoryIndex index.php | ||
| + | |||
| + | |||
| + | # Use separate log files for the SSL virtual host; note that LogLevel | ||
| + | # is not inherited from httpd.conf. | ||
| + | # Django : 2014-08-30 | ||
| + | # default: ErrorLog logs/ | ||
| + | # TransferLog logs/ | ||
| + | ErrorLog logs/ | ||
| + | TransferLog logs/ | ||
| + | LogLevel warn | ||
| + | |||
| + | # SSL Engine Switch: | ||
| + | # | ||
| + | SSLEngine on | ||
| + | |||
| + | # SSL Protocol support: | ||
| + | # List the enable protocol levels with which clients will be able to | ||
| + | # connect. | ||
| + | # Django : 2014-08-30 Nur die beiden folgenden Protokolle SSLv3 und TLSv1 anbieten: | ||
| + | # default: SSLProtocol all -SSLv2 | ||
| + | SSLProtocol All -SSLv2 -SSLv3 | ||
| + | |||
| + | # SSL Cipher Suite: | ||
| + | # List the ciphers that the client is permitted to negotiate. | ||
| + | # See the mod_ssl documentation for a complete list. | ||
| + | # Django : 2014-08-30 | ||
| + | # default: SSLCipherSuite HIGH: | ||
| + | # Docu : http:// | ||
| + | SSLCipherSuite EECDH+AES256: | ||
| + | |||
| + | # | ||
| + | # If speed is your main concern (on busy HTTPS servers e.g.), | ||
| + | # you might want to force clients to specific, performance | ||
| + | # | ||
| + | # to the SSLCipherSuite list, and enable SSLHonorCipherOrder. | ||
| + | # | ||
| + | # (as in the example below), most connections will no longer | ||
| + | # have perfect forward secrecy - if the server' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # Django : 2014-8-30 | ||
| + | # default: # | ||
| + | SSLHonorCipherOrder on | ||
| + | |||
| + | # | ||
| + | # Point SSLCertificateFile at a PEM encoded certificate. | ||
| + | # the certificate is encrypted, then you will be prompted for a | ||
| + | # pass phrase. | ||
| + | # certificate can be generated using the genkey(1) command. | ||
| + | # Django : 2014-08-30 | ||
| + | # default: SSLCertificateFile / | ||
| + | SSLCertificateFile / | ||
| + | |||
| + | # | ||
| + | # If the key is not combined with the certificate, | ||
| + | # | ||
| + | # | ||
| + | # both in parallel (to also allow the use of DSA ciphers, etc.) | ||
| + | # Django : 2014-08-30 | ||
| + | # default: SSLCertificateKeyFile / | ||
| + | SSLCertificateKeyFile / | ||
| + | |||
| + | # | ||
| + | # Point SSLCertificateChainFile at a file containing the | ||
| + | # | ||
| + | # | ||
| + | # the referenced file can be the same as SSLCertificateFile | ||
| + | # when the CA certificates are directly appended to the server | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # Set the CA certificate verification path where to find CA | ||
| + | # | ||
| + | # huge file containing all of them (file must be PEM encoded) | ||
| + | # | ||
| + | # Django : 2014-08-30 | ||
| + | # default: unset | ||
| + | SSLCACertificateFile / | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # none, optional, require and optional_no_ca. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # With SSLRequire you can do per-directory access control based | ||
| + | # on arbitrary complex boolean expressions containing server | ||
| + | # | ||
| + | # | ||
| + | # for more details. | ||
| + | #< | ||
| + | #SSLRequire ( %{SSL_CIPHER} !~ m/ | ||
| + | # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ | ||
| + | # and %{SSL_CLIENT_S_DN_OU} in {" | ||
| + | # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ | ||
| + | # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ | ||
| + | # or %{REMOTE_ADDR} =~ m/ | ||
| + | #</ | ||
| + | |||
| + | # SSL Engine Options: | ||
| + | # Set various options for the SSL engine. | ||
| + | # o FakeBasicAuth: | ||
| + | # | ||
| + | # the standard Auth/ | ||
| + | # user name is the `one line' version of the client' | ||
| + | # Note that no password is obtained from the user. Every entry in the user | ||
| + | # file needs this password: `xxj31ZMTZzkVA' | ||
| + | # o ExportCertData: | ||
| + | # This exports two additional environment variables: SSL_CLIENT_CERT and | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # into CGI scripts. | ||
| + | # o StdEnvVars: | ||
| + | # This exports the standard SSL/TLS related `SSL_*' | ||
| + | # Per default this exportation is switched off for performance reasons, | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # o StrictRequire: | ||
| + | # This denies access when " | ||
| + | # under a " | ||
| + | # and no other module can change it. | ||
| + | # o OptRenegotiate: | ||
| + | # This enables optimized SSL connection renegotiation handling when SSL | ||
| + | # | ||
| + | #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire | ||
| + | <Files ~ " | ||
| + | SSLOptions +StdEnvVars | ||
| + | </ | ||
| + | < | ||
| + | SSLOptions +StdEnvVars | ||
| + | </ | ||
| + | |||
| + | # SSL Protocol Adjustments: | ||
| + | # The safe and default but still SSL/TLS standard compliant shutdown | ||
| + | # | ||
| + | # the close notify alert from client. When you need a different shutdown | ||
| + | # | ||
| + | # o ssl-unclean-shutdown: | ||
| + | # This forces an unclean shutdown when the connection is closed, i.e. no | ||
| + | # SSL close notify alert is send or allowed to received. | ||
| + | # the SSL/TLS standard but is needed for some brain-dead browsers. Use | ||
| + | # this when you receive I/O errors because of the standard approach where | ||
| + | # | ||
| + | # o ssl-accurate-shutdown: | ||
| + | # This forces an accurate shutdown when the connection is closed, i.e. a | ||
| + | # SSL close notify alert is send and mod_ssl waits for the close notify | ||
| + | # alert of the client. This is 100% SSL/TLS standard compliant, but in | ||
| + | # | ||
| + | # this only for browsers where you know that their SSL implementation | ||
| + | # works correctly. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # their broken HTTP/1.1 implementation. Use variables " | ||
| + | # " | ||
| + | BrowserMatch "MSIE [2-5]" \ | ||
| + | | ||
| + | | ||
| + | |||
| + | # | ||
| + | # The home of a custom SSL log file. Use this when you want a | ||
| + | # | ||
| + | CustomLog logs/ | ||
| + | "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \" | ||
| + | |||
| + | </ | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | # systemctl start httpd.service | ||
| + | < | ||
| + | [Sat Aug 30 15: | ||
| + | [Sat Aug 30 15: | ||
| + | [Sat Aug 30 15: | ||
| + | [Sat Aug 30 15: | ||
| + | </ | ||
| + | |||
| + | # less / | ||
| + | < | ||
| + | 10.0.0.20 - - [30/ | ||
| + | 10.0.0.20 - - [30/ | ||
| + | </ | ||
| + | |||
| + | # less / | ||
| + | < | ||
| + | [30/ | ||
| + | [30/ | ||
| + | </ | ||
| + | |||
| + | https:// | ||
| + | |||
| + | https:// | ||
| + | |||
| + | ==== HSTS ==== | ||
| + | |||
| + | |||
| + | In der vHost-Definition unseres Apache-vHOST ergänzen wir folgende Zeile '' | ||
| + | # vim / | ||
| + | |||
| + | <code bash>... | ||
| + | |||
| + | # HTTP Strict Transport Security (HSTS), bei dem der Server dem Client im | ||
| + | # HTTP-Header mitteilt, dass dieser nur noch verschlüsselt mit dem Server | ||
| + | # kommunizieren soll. | ||
| + | Header always set Strict-Transport-Security " | ||
| + | |||
| + | ...</ | ||
| + | |||
| + | ==== OCSP Stapling ==== | ||
| + | |||
| + | In der // | ||
| + | # vim / | ||
| + | <code bash>... | ||
| + | |||
| + | # Django : 2015-11-11 | ||
| + | # Chache-Definition für Online Certificate Status Protocol stapling | ||
| + | SSLStaplingCache " | ||
| + | |||
| + | ...</ | ||
| + | |||
| + | In der vHost-Definition unseres Apache-vHOST ergänzen wir folgende drei Zeilen. | ||
| + | # vim / | ||
| + | |||
| + | <code bash>... | ||
| + | |||
| + | # Online Certificate Status Protocol stapling zum Prüfen des Gültigkeitsstatus | ||
| + | # des Serverzertifikats. | ||
| + | SSLUseStapling | ||
| + | SSLStaplingResponderTimeout 5 | ||
| + | SSLStaplingReturnResponderErrors off | ||
| + | |||
| + | ...</ | ||
| + | |||
| + | |||
| + | $ openssl s_client -connect forum.nausch.org: | ||
| + | < | ||
| + | depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA | ||
| + | verify return:1 | ||
| + | depth=1 C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2 | ||
| + | verify return:1 | ||
| + | depth=0 OU = Domain Control Validated, CN = forum.nausch.org | ||
| + | verify return:1 | ||
| + | OCSP response: | ||
| + | ====================================== | ||
| + | OCSP Response Data: | ||
| + | OCSP Response Status: successful (0x0) | ||
| + | Response Type: Basic OCSP Response | ||
| + | Version: 1 (0x0) | ||
| + | Responder Id: EE5EFFFE85DB26C626FBD3698410AD1D0DD3EF58 | ||
| + | Produced At: Nov 29 18:16:05 2016 GMT | ||
| + | Responses: | ||
| + | Certificate ID: | ||
| + | Hash Algorithm: sha1 | ||
| + | Issuer Name Hash: 84D56BF8098BD307B766D8E1EBAD6596AA6B6761 | ||
| + | Issuer Key Hash: F5CDD53C0850F96A4F3AB797DA5683E669D268F7 | ||
| + | Serial Number: 6922D213277B49AC169E77A9 | ||
| + | Cert Status: good | ||
| + | This Update: Nov 29 18:16:05 2016 GMT | ||
| + | Next Update: Dec 3 18:16:05 2016 GMT | ||
| + | |||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Werden **__keine__** OCSP-Response Daten angezeigt, ist dies ein Hinweis, dass die OCSP_Konfiguration nnoch nicht richtig abgeschlossen wurde! | ||
| + | |||
| + | Zum Testen kann man alternativ auch den Test bei [[https:// | ||
| + | |||
| + | ==== Secure Cookie mit HttpOnly ==== | ||
| + | |||
| + | In der vHost-Definition unseres Apache-vHOST ergänzen wir folgende Zeile '' | ||
| + | '' | ||
| + | # vim / | ||
| + | |||
| + | <code bash>... | ||
| + | |||
| + | # Add Secure and HTTP only attributes to cookies | ||
| + | Header edit Set-Cookie ^(.*)$ $1; | ||
| + | |||
| + | ...</ | ||
| + | |||
| + | https:// | ||
| + | |||
| + | | set-cookie: | ||
| + | |||
| + | **HttpOnly** und **Secure** kennzeichnen die erfolgreiche Änderung! | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | ==== HPKP ==== | ||
| + | [[https:// | ||
| + | # openssl rsa -pubout -in / | ||
| + | | ||
| + | |||
| + | writing RSA key | ||
| + | nMiOpb6vUnjCoWCkPkDaG4ND8SNWzFTsQf2ZfruLno0= | ||
| + | |||
| + | pin-sha256=" | ||
| + | |||
| + | # openssl rsa -pubout -in / | ||
| + | | ||
| + | |||
| + | writing RSA key | ||
| + | INhxSQ38nCS6ijaAAyo4xAhAZj9xeL3Xaak+GGiM2fo= | ||
| + | |||
| + | Zum Löschen von outdated bzw. falschen key-hashes beim Firefox zuerst einam den Browser stoppen. Anschließend bearbeiten wir die Einträge in der Datei **SiteSecurityServiceState.txt** im profile-Pafd unserer Installation. | ||
| + | # vim ~/ | ||
| + | |||
| + | Nach dem Speichern unserer Änderungen starten wir den Browser neu und können wieder auf die zuvor blockierten Seiten zugreifen. | ||
| + | |||
| + | ===== Tests ===== | ||
| + | |||
| + | Artikel auf [[http:// | ||
| + | [[https:// | ||
| + | [[https:// | ||
| + | [[https:// | ||
django