3.7.3. Configuring Specific Applications
Different applications provide their own configuration mechanisms for
TLS. This section describes the
TLS-related configuration files employed by the most commonly used server applications and offers examples of typical configurations.
Regardless of the configuration you choose to use, always make sure to mandate that your server application enforces server-side cipher order, so that the cipher suite to be used is determined by the order you configure.
184.108.40.206. Configuring the Apache HTTP Server
The Apache HTTP Server can use both OpenSSL and NSS libraries for its
TLSneeds. Depending on your choice of the
TLSlibrary, you need to install either the mod_ssl or the mod_nss module (provided by eponymous packages). For example, to install the package that provides the OpenSSL mod_ssl module, issue the following command as root:
yum install mod_ssl
The mod_ssl package installs the
/etc/httpd/conf.d/ssl.confconfiguration file, which can be used to modify the
TLS-related settings of the Apache HTTP Server. Similarly, the mod_nss package installs the
Install the httpd-manual package to obtain a complete documentation for the Apache HTTP Server, including
TLSconfiguration. The directives available in the
/etc/httpd/conf.d/ssl.confconfiguration file are described in detail in
/usr/share/httpd/manual/mod/mod_ssl.html. Examples of various settings are in
When modifying the settings in the
/etc/httpd/conf.d/ssl.confconfiguration file, be sure to consider the following three directives at the minimum:
- Use this directive to specify the version of
SSL) you want to allow.
- Use this directive to specify your preferred cipher suite or disable the ones you want to disallow.
- Uncomment and set this directive to
onto ensure that the connecting clients adhere to the order of ciphers you specified.
SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite HIGH:!aNULL:!MD5 SSLHonorCipherOrder on
Note that the above configuration is the bare minimum, and it can be hardened significantly by following the recommendations outlined in Section 3.7.1, “Choosing Algorithms to Enable”.
To configure and use the mod_nss module, modify the
/etc/httpd/conf.d/nss.confconfiguration file. The mod_nss module is derived from mod_ssl, and as such it shares many features with it, not least the structure of the configuration file, and the directives that are available. Note that the mod_nss directives have a prefix of
SSL. See https://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html for an overview of information about mod_nss, including a list of mod_ssl configuration directives that are not applicable to mod_nss.