emunhi/https repository overview

yum -y update && yum clean all && yum -y install httpd mod_ssl mkdir /etc/ssl/private chmod 700 /etc/ssl/private

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/private.key -out /etc/ssl/certs/mysigned.crt openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 cat /etc/ssl/certs/dhparam.pem | tee -a /etc/ssl/certs/mysigned.crt

⁠vi /etc/httpd/conf.d/ssl.conf

DocumentRoot "/var/www/html" ServerName www.example.com:443

⁠SSLProtocol all -SSLv2 -SSLv3

⁠SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

SSLCertificateFile /etc/ssl/certs/mysigned.crt SSLCertificateKeyFile /etc/ssl/private/private.key

⁠https://cipherli.st/⁠

⁠https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html⁠

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On

⁠Disable preloading HSTS for now. You can use the commented out header line that includes

⁠the "preload" directive if you understand the implications.

#Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains" Header always set X-Frame-Options DENY Header always set X-Content-Type-Options nosniff

⁠Requires Apache >= 2.4

SSLCompression off SSLUseStapling on SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

⁠Requires Apache >= 2.4.11

⁠SSLSessionTickets Off

---

⁠vi /etc/httpd/conf.d/non-ssl.conf

⁠<VirtualHost *:80> ServerName 192.168.99.100 Redirect "/" "https://192.168.99.100/⁠"

vi /etc/httpd/conf/httpd.conf ServerName localhost

/usr/sbin/httpd -k start