|
1
|
<IfModule mod_ssl.c>
|
|
2
|
NameVirtualHost *:443
|
|
3
|
<VirtualHost *:443>
|
|
4
|
DocumentRoot /var/lib/tomcat6/webapps/metacat
|
|
5
|
|
|
6
|
ScriptAlias /metacat/cgi-bin/ /var/lib/tomcat6/webapps/metacat/cgi-bin/
|
|
7
|
<Directory "/var/lib/tomcat6/webapps/metacat/cgi-bin/">
|
|
8
|
AllowOverride All
|
|
9
|
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
|
10
|
Order allow,deny
|
|
11
|
Allow from all
|
|
12
|
</Directory>
|
|
13
|
|
|
14
|
<IfModule mod_rewrite.c>
|
|
15
|
RewriteEngine on
|
|
16
|
RewriteCond %{HTTP:Authorization} ^(.*)
|
|
17
|
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
|
|
18
|
</IfModule>
|
|
19
|
|
|
20
|
<IfModule mod_jk.c>
|
|
21
|
JkMount /metacat ajp13
|
|
22
|
JkMount /metacat/* ajp13
|
|
23
|
JkMount /metacat/metacat ajp13
|
|
24
|
JkMount /*.jsp ajp13
|
|
25
|
JkUnMount /metacat/cgi-bin/* ajp13
|
|
26
|
|
|
27
|
JkOptions +ForwardURICompatUnparsed
|
|
28
|
</IfModule>
|
|
29
|
|
|
30
|
AllowEncodedSlashes On
|
|
31
|
AcceptPathInfo On
|
|
32
|
|
|
33
|
# SSL Engine Switch:
|
|
34
|
# Enable/Disable SSL for this virtual host.
|
|
35
|
SSLEngine on
|
|
36
|
SSLOptions +StrictRequire +StdEnvVars +ExportCertData
|
|
37
|
|
|
38
|
# A self-signed (snakeoil) certificate can be created by installing
|
|
39
|
# the ssl-cert package. See
|
|
40
|
# /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
|
|
41
|
# If both key and certificate are stored in the same file, only the
|
|
42
|
# SSLCertificateFile directive is needed.
|
|
43
|
SSLCertificateFile /etc/ssl/certs/<your_cert_name>.crt
|
|
44
|
SSLCertificateKeyFile /etc/ssl/private/<your_cert_name>.key
|
|
45
|
SSLCertificateChainFile /etc/ssl/certs/<CA chain file>.crt
|
|
46
|
|
|
47
|
# Certificate Authority (CA):
|
|
48
|
# Set the CA certificate verification path where to find CA
|
|
49
|
# certificates for client authentication or alternatively one
|
|
50
|
# huge file containing all of them (file must be PEM encoded)
|
|
51
|
# Note: Inside SSLCACertificatePath you need hash symlinks
|
|
52
|
# to point to the certificate files. Use the provided
|
|
53
|
# Makefile to update the hash symlinks after changes.
|
|
54
|
# Use the correct DataONE chain for validating client certificates
|
|
55
|
# see: https://repository.dataone.org/software/tools/trunk/ca
|
|
56
|
SSLCACertificatePath /etc/ssl/certs/
|
|
57
|
#SSLCACertificateFile /etc/ssl/certs/DataONECAChain.crt
|
|
58
|
SSLVerifyClient optional
|
|
59
|
SSLVerifyDepth 10
|
|
60
|
|
|
61
|
# Client Authentication (Type):
|
|
62
|
# Client certificate verification type and depth. Types are
|
|
63
|
# none, optional, require and optional_no_ca. Depth is a
|
|
64
|
# number which specifies how deeply to verify the certificate
|
|
65
|
# issuer chain before deciding the certificate is not valid.
|
|
66
|
<Location /metacat/servlet/replication>
|
|
67
|
SSLVerifyClient require
|
|
68
|
SSLVerifyDepth 10
|
|
69
|
</Location>
|
|
70
|
|
|
71
|
# disable SSL v2 and v3
|
|
72
|
# intermediate configuration from https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
|
73
|
SSLProtocol all -SSLv2 -SSLv3
|
|
74
|
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
|
|
75
|
SSLHonorCipherOrder on
|
|
76
|
|
|
77
|
</VirtualHost>
|
|
78
|
</IfModule>
|
|
79
|
|