Certificat SSL Snakeoil

• On peut tester la "validité" ou la sécurité d'un certificat ssl sur :

- https://www.ssllabs.com/ssltest/index.html

- https://cryptoreport.geotrust.com/checker/

- https://www.digicert.com/help/

- https://securityheaders.com

Le "SSLCACertificateFile" peut se récuperer sur la page : http://www.networking4all.com/en/support/tools/site+check/report/?fqdn=blaxeen.com&protocol=https

le module mod_ssl.so doit etre activé et Apache doit écouter sur le port 443 (en + du 80 selon la config)

# cd /etc/apache
# openssl genrsa 1024 > www.mondomaine.com.key
# openssl req -new -key www.mondomaine.com.key > www.mondomaine.com.csr
# openssl x509 -req -days 365 -in www.mondomaine.com.csr -signkey www.mondomaine.com.key -out www.mondomaine.com.crt

Dans le virtualhost concerné, ajouter les lignes suivantes : (voir le site https://mozilla.github.io/server-side-tls/ssl-config-generator/ pour les conf)

<VirtualHost 111.222.333.444:443>
<VirtualHost *:443>
    ...
    SSLEngine on
    SSLCertificateFile      /path/to/signed_certificate_followed_by_intermediate_certs
    SSLCertificateKeyFile   /path/to/private/key

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication


    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=15768000"
    ...
</VirtualHost>

# modern configuration, tweak to your needs
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling          on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache        shmcb:/var/run/ocsp(128000)