ssl_stapling_verify – Otto: thoughts and rants

Set-up HTTPS with Free certificate

– แบบ gen เอง

# a2enmod ssl
# make-ssl-cert generate-default-snakeoil -force-overwrite

เติมใน apache conf

SSLEngine on

SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

SSLOptions +StdEnvVars

BrowserMatch "MSIE [2-6]"
nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

แบบใช้ let’s encrypt free sir

https://certbot.eff.org/#ubuntutrusty-apache

cd /usr/local/sbin/
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
./certbot-auto
ตอบไปตามขั้นตอน มันจะแก้ apache config ให้เสร็จ

update ทดลอง
/usr/local/sbin/certbot-auto renew -dry-run

update จริง
/usr/local/sbin/certbot-auto renew --quiet --no-self-upgrade

ใส่ใน cron

0 0 * * *  python -c 'import random; import time; time.sleep(random.random() * 43200)' && PATH=/usr/sbin:$PATH /usr/local/sbin/certbot-auto renew  --quiet # --no-self-upgrade

สร้าง dhparm.pem

cd /etc/apache2 ; openssl dhparam -out dhparams.pem 2048

แล้วก็ตัดแปะผลลัพธ์ไปต่อท้าย SSL Certificate file ที่ใช้

เติมใน /etc/apache2/mods-enabled/ssl.conf

# Ott added April 7, 2016
SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

SSLHonorCipherOrder on

#SSLOpenSSLConfCmd Curves secp384r1
#SSLOpenSSLConfCmd DHParameters "/etc/apache2/dhparam.pem"

บางครั้งมีปัญหาเรื่อง tls-sni-01 challenge
เป็นจากสองบรรทัดนี้ ต้องเอาออกถึงจะ renew cert ได้

#ssl_stapling on;
#ssl_stapling_verify on;

(วิธี renew แบบใช้ standalone authen - nginx จะ down ไปแป็บนึง ไม่ดีนัก)
certbot-auto --authenticator standalone --installer nginx -d http://www-test.abc.com --pre-hook "service nginx stop" --post-hook "service nginx start"

ใช้ Cer ที่ที่ซื้อมา, ถ้าใช้ Apache config ประมาณนี้ (สังเกตว่า SSLPassPhraseDialog อยู่นอก VirtualHost


  SSLCertificateFile /etc/apache2/ssl/mycer.cer
  SSLCertificateKeyFile /etc/apache2/ssl/mycer.key
  SSLCertificateChainFile /etc/apache2/ssl/mycer.cer
</VirtualHost>


SSLPassPhraseDialog exec:/etc/apache2/ssl/mycer-passphrase-file.sh

โดยที่ข้างใน /etc/apache2/ssl/mycer-passphrase-file.sh คือ (chmod +x)

#!/bin/sh
cat /etc/apache2/ssl/mycer.pass

แต่ถ้า nginx ง่ายกว่า

    ssl_certificate /etc/nginx/ssl/mycer.cer;
    ssl_password_file /etc/nginx/ssl/mycer.passwd;
    ssl_certificate_key /etc/nginx/ssl/mycer.key;

Ubuntu NGINX Set-up + SSL

1. สร้าง dhparam.pem
cd /etc/ssl/certs/
openssl dhparam -out dhparam.pem 2048

2. เติม ใน /etc/nginx/nginx.conf

log_format timing ‘$remote_addr – $remote_user [$time_local] $request ‘
‘by $upstream_addr uptime $upstream_response_time ‘
‘mytime $request_time’;

# Specify a log format compatible with Apache’s combined format
log_format main ‘$remote_addr – $remote_user [$time_local] ‘
‘”$request” $status $body_bytes_sent “$http_referer” ‘
‘”$http_user_agent” “$http_x_forwarded_for” ‘
‘by “$upstream_addr” uptime “$upstream_response_time” ‘
‘mytime “$request_time” ‘;

log_format up_head ‘$remote_addr – $remote_user [$time_local] $request ‘
‘upstream_http_content_type $upstream_http_content_type’;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers ‘ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA’;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;

# มีปัญหากับ certbot-auto renew
#ssl_stapling on;
#ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;

3. mkdir /etc/nginx/ssl/
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

4. nginx site config

listen 443 ssl;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;

5. config ที่ใช้บ่อยๆ

location /phppgadmin {
root /usr/share/;
index index.php;
location ~ ^/phppgadmin/(.+.php)$ {
try_files $uri =404;
fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
fastcgi_index index.php;
include fastcgi.conf;
fastcgi_read_timeout 86400;
}

auth_basic “DB Staff”;
auth_basic_user_file /etc/phppgadmin/htpasswd;
}

#location /jasperserver {
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_pass http://127.0.0.1:8081/jasperserver;
# proxy_read_timeout 900;
#}

#location /highchartsexport {
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_pass http://127.0.0.1:7801/;
# proxy_read_timeout 900;
#}

location /geoserver {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://127.0.0.1:8080/geoserver;

#proxy_pass http://geoserverservers/geoserver/;
#proxy_set_header Host $host;
#proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header X-Forwarded-Proto https;

}