| 1 |
4926
|
daigle
|
<IfModule mod_ssl.c>
|
| 2 |
4990
|
tao
|
NameVirtualHost *:443
|
| 3 |
4926
|
daigle
|
<VirtualHost *:443>
|
| 4 |
8265
|
leinfelder
|
DocumentRoot /var/lib/tomcat6/webapps/metacat
|
| 5 |
4926
|
daigle
|
|
| 6 |
8265
|
leinfelder
|
ScriptAlias /metacat/cgi-bin/ /var/lib/tomcat6/webapps/metacat/cgi-bin/
|
| 7 |
|
|
<Directory "/var/lib/tomcat6/webapps/metacat/cgi-bin/">
|
| 8 |
4926
|
daigle
|
AllowOverride All
|
| 9 |
|
|
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
| 10 |
|
|
Order allow,deny
|
| 11 |
|
|
Allow from all
|
| 12 |
|
|
</Directory>
|
| 13 |
|
|
|
| 14 |
|
|
<IfModule mod_jk.c>
|
| 15 |
8265
|
leinfelder
|
JkMount /metacat ajp13
|
| 16 |
|
|
JkMount /metacat/* ajp13
|
| 17 |
|
|
JkMount /metacat/metacat ajp13
|
| 18 |
4926
|
daigle
|
JkMount /*.jsp ajp13
|
| 19 |
8265
|
leinfelder
|
JkUnMount /metacat/cgi-bin/* ajp13
|
| 20 |
7052
|
pippin
|
|
| 21 |
|
|
JkOptions +ForwardURICompatUnparsed
|
| 22 |
4926
|
daigle
|
</IfModule>
|
| 23 |
7052
|
pippin
|
|
| 24 |
|
|
AllowEncodedSlashes On
|
| 25 |
|
|
AcceptPathInfo On
|
| 26 |
6812
|
leinfelder
|
|
| 27 |
4926
|
daigle
|
# SSL Engine Switch:
|
| 28 |
|
|
# Enable/Disable SSL for this virtual host.
|
| 29 |
|
|
SSLEngine on
|
| 30 |
7357
|
leinfelder
|
SSLOptions +StrictRequire +StdEnvVars +ExportCertData
|
| 31 |
6812
|
leinfelder
|
|
| 32 |
4926
|
daigle
|
# A self-signed (snakeoil) certificate can be created by installing
|
| 33 |
|
|
# the ssl-cert package. See
|
| 34 |
|
|
# /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
|
| 35 |
|
|
# If both key and certificate are stored in the same file, only the
|
| 36 |
|
|
# SSLCertificateFile directive is needed.
|
| 37 |
|
|
SSLCertificateFile /etc/ssl/certs/<your_cert_name>.crt
|
| 38 |
|
|
SSLCertificateKeyFile /etc/ssl/private/<your_cert_name>.key
|
| 39 |
8289
|
leinfelder
|
SSLCertificateChainFile /etc/ssl/certs/<CA chain file>.crt
|
| 40 |
6812
|
leinfelder
|
|
| 41 |
|
|
# Certificate Authority (CA):
|
| 42 |
|
|
# Set the CA certificate verification path where to find CA
|
| 43 |
|
|
# certificates for client authentication or alternatively one
|
| 44 |
|
|
# huge file containing all of them (file must be PEM encoded)
|
| 45 |
|
|
# Note: Inside SSLCACertificatePath you need hash symlinks
|
| 46 |
|
|
# to point to the certificate files. Use the provided
|
| 47 |
|
|
# Makefile to update the hash symlinks after changes.
|
| 48 |
8707
|
leinfelder
|
# Use the correct DataONE chain for validating client certificates
|
| 49 |
|
|
# see: https://repository.dataone.org/software/tools/trunk/ca
|
| 50 |
6812
|
leinfelder
|
SSLCACertificatePath /etc/ssl/certs/
|
| 51 |
8707
|
leinfelder
|
#SSLCACertificateFile /etc/ssl/certs/DataONECAChain.crt
|
| 52 |
|
|
SSLVerifyClient optional
|
| 53 |
|
|
SSLVerifyDepth 10
|
| 54 |
6812
|
leinfelder
|
|
| 55 |
|
|
# Client Authentication (Type):
|
| 56 |
|
|
# Client certificate verification type and depth. Types are
|
| 57 |
|
|
# none, optional, require and optional_no_ca. Depth is a
|
| 58 |
|
|
# number which specifies how deeply to verify the certificate
|
| 59 |
|
|
# issuer chain before deciding the certificate is not valid.
|
| 60 |
8265
|
leinfelder
|
<Location /metacat/servlet/replication>
|
| 61 |
6812
|
leinfelder
|
SSLVerifyClient require
|
| 62 |
|
|
SSLVerifyDepth 10
|
| 63 |
|
|
</Location>
|
| 64 |
4926
|
daigle
|
|
| 65 |
9270
|
leinfelder
|
# disable SSL v2 and v3
|
| 66 |
|
|
# intermediate configuration from https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
| 67 |
|
|
SSLProtocol all -SSLv2 -SSLv3
|
| 68 |
|
|
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
|
| 69 |
|
|
SSLHonorCipherOrder on
|
| 70 |
|
|
|
| 71 |
4926
|
daigle
|
</VirtualHost>
|
| 72 |
|
|
</IfModule>
|