LINUX

Cấu hình SSL trên APACHE

3198

Contents

1. Cấu hình VirtualHost và tự động chuyển từ HTTP sang HTTPS

1. Cấu hình VirtualHost và tự động chuyển từ HTTP sang HTTPS

1.1 Kiểm tra module SSL đã được khai báo trong file cấu hình

cat /etc/httpd/conf/httpd.conf | grep ssl_module

Kiểm tra vị trí thư mục modules và khai báo

LoadModule ssl_module modules/mod_ssl.so

1.2 Chuyển HTTP sang HTTPS

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName files.diennuocdaiphong.com
    ServerAlias www.files.diennuocdaiphong.com
	RewriteEngine On
	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
    ErrorLog /opt/hoang-nextcloud/file-error.log
    CustomLog /opt/hoang-nextcloud/file-access.log combined
</VirtualHost>

1.3 Cấu hình SSL

<VirtualHost *:443>

	ServerName files.diennuocdaiphong.com:443
	DocumentRoot "/opt/hoang-nextcloud/"  
	<Directory "/opt/hoang-nextcloud">
		 AllowOverride all
		 Require all granted
	</Directory>
	ErrorLog /opt/hoang-nextcloud/nextcloud-error.log
	CustomLog /opt/hoang-nextcloud/nextcloud-access.log combined
	
	ErrorLog /opt/hoang-nextcloud/ssl_error_log
	TransferLog /opt/hoang-nextcloud/ssl_access_log
	LogLevel warn
	SSLEngine on
	SSLProtocol all -SSLv2 -SSLv3
	SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

	SSLHonorCipherOrder on
	SSLOptions +StrictRequire

	SSLCertificateFile /etc/letsencrypt/live/files.diennuocdaiphong.com/cert.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/files.diennuocdaiphong.com/privkey.pem
	SSLCertificateChainFile /etc/letsencrypt/live/files.diennuocdaiphong.com/chain.pem

	<Files ~ "\.(cgi|shtml|phtml|php3?)$">
		SSLOptions +StdEnvVars
	</Files>
	<Directory "/var/www/cgi-bin">
		SSLOptions +StdEnvVars
	</Directory>

	BrowserMatch "MSIE [2-5]" \
	nokeepalive ssl-unclean-shutdown \
	downgrade-1.0 force-response-1.0

	CustomLog logs/ssl_request_log \
	"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

Chú ý: