Refresh cipher suites and protocols
The last update was 2016, and it's time to drop TLSv1 and TLSv1.1 as the
base configuration recommended by Mozilla.
https://wiki.mozilla.org/Security/Server_Side_TLS
Follow-up of the following commits:
106f418f13
Related changes in charm-helpers:
https://github.com/juju/charm-helpers/pull/485
Change-Id: Ib959663634bc648328e5cb35ed3d3622d759412c
Closes-Bug: #1886630
This commit is contained in:
parent
ce9017ea98
commit
e462df7401
|
@ -36,8 +36,14 @@ NameVirtualHost *:{{ 443 }}
|
|||
CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
|
||||
|
||||
SSLEngine on
|
||||
SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
|
||||
SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!EXP:!LOW:!MEDIUM
|
||||
|
||||
# This section is based on Mozilla's recommendation
|
||||
# as the "intermediate" profile as of July 7th, 2020.
|
||||
# https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
||||
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
||||
SSLHonorCipherOrder off
|
||||
|
||||
SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert_{{ endpoint }}
|
||||
# See LP 1484489 - this is to support <= 2.4.7 and >= 2.4.8
|
||||
SSLCertificateChainFile /etc/apache2/ssl/{{ namespace }}/cert_{{ endpoint }}
|
||||
|
|
Loading…
Reference in New Issue