Skip to content

Commit 55c364d

Browse files
LeoColombLeoColomb
committed
Modernize TLS configuration
1 parent 6d6e4d5 commit 55c364d

10 files changed

+22
-45
lines changed

‎h5bp/ssl/policy_deprecated.conf

-23
This file was deleted.

‎h5bp/ssl/certificate_files.conf ‎h5bp/tls/certificate_files.conf

File renamed without changes.

‎h5bp/ssl/ocsp_stapling.conf ‎h5bp/tls/ocsp_stapling.conf

File renamed without changes.

‎h5bp/ssl/policy_intermediate.conf ‎h5bp/tls/policy_balanced.conf

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,9 @@
11
# ----------------------------------------------------------------------
2-
# | SSL policy - Intermediate |
2+
# | SSL policy - Balanced |
33
# ----------------------------------------------------------------------
44

5-
# For services that don't need backward compatibility, the parameters below
6-
# provide a higher level of security.
7-
#
8-
# (!) This policy enforces a mildly strong SSL configuration, which may raise
9-
# errors with old clients.
10-
# If a more compatible profile is required, use the "deprecated" policy.
5+
# For services that need to support a wide range of clients, this configuration
6+
# is raisonnably balanced.
117
#
128
# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
139
# https://httpd.apache.org/docs/current/ssl/ssl_howto.html

‎h5bp/ssl/policy_modern.conf ‎h5bp/tls/policy_strict.conf

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
# ----------------------------------------------------------------------
2-
# | SSL policy - Modern |
2+
# | SSL policy - Strict |
33
# ----------------------------------------------------------------------
44

5-
# For services that want to be on the bleeding edge, the parameters below
6-
# sacrifice compatibility for the highest level of security and performance.
5+
# For services that don't need backward compatibility, the parameters below
6+
# provide the highest level of security and performance.
7+
#
8+
# (!) This policy enforces a strong TLS configuration, which may raise
9+
# errors with old clients.
10+
# If a more compatible profile is required, use the "balanced" policy.
711
#
812
# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak
913
# and potentially vulnerable.

‎h5bp/ssl/ssl_engine.conf ‎h5bp/tls/ssl_engine.conf

File renamed without changes.

‎test/vhosts/000-default.conf

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
</VirtualHost>
44

55
<VirtualHost *:443>
6-
Include h5bp/ssl/ssl_engine.conf
7-
Include h5bp/ssl/certificate_files.conf
8-
Include h5bp/ssl/policy_intermediate.conf
6+
Include h5bp/tls/ssl_engine.conf
7+
Include h5bp/tls/certificate_files.conf
8+
Include h5bp/tls/policy_balanced.conf
99
</VirtualHost>

‎test/vhosts/secure.server.localhost.conf

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55

66
DocumentRoot "/usr/local/apache2/htdocs"
77

8-
Include h5bp/ssl/ssl_engine.conf
9-
Include h5bp/ssl/certificate_files.conf
10-
Include h5bp/ssl/policy_intermediate.conf
8+
Include h5bp/tls/ssl_engine.conf
9+
Include h5bp/tls/certificate_files.conf
10+
Include h5bp/tls/policy_balanced.conf
1111

1212
Include h5bp/rewrites/rewrite_nowww.conf
1313

‎vhosts/.000-default.conf

+3-3
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
# as the first loaded one.
1111

1212
<VirtualHost *:443>
13-
Include h5bp/ssl/ssl_engine.conf
14-
Include h5bp/ssl/certificate_files.conf
15-
Include h5bp/ssl/policy_intermediate.conf
13+
Include h5bp/tls/ssl_engine.conf
14+
Include h5bp/tls/certificate_files.conf
15+
Include h5bp/tls/policy_intermediate.conf
1616
</VirtualHost>

‎vhosts/templates/example.com.conf

+3-3
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@
1717
# Path for static files
1818
DocumentRoot "/var/www/example.com/public"
1919

20-
Include h5bp/ssl/ssl_engine.conf
21-
Include h5bp/ssl/certificate_files.conf
22-
Include h5bp/ssl/policy_intermediate.conf
20+
Include h5bp/tls/ssl_engine.conf
21+
Include h5bp/tls/certificate_files.conf
22+
Include h5bp/tls/policy_intermediate.conf
2323

2424
# (1)
2525
Include h5bp/rewrites/rewrite_nowww.conf

0 commit comments

Comments
 (0)