суббота, 12 апреля 2014 г.

Настройка Lighttpd "Grade A+" SSL Server Test от ssllabs.com

Настройки lighttpd для прохождения SSL теста ssllabs.com на A+.

/etc/lighttpd/conf-enabled/10-ssl.conf
$SERVER["socket"] == "0.0.0.0:443" {
ssl.engine = "enable"
ssl.ca-file = "/etc/lighttpd/pki/ca-certs.crt"
ssl.pemfile = "/etc/lighttpd/pki/ssl.crt"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "enable"
ssl.use-compression = "disable"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
}

#Включение HSTS
server.modules += ( "mod_setenv" )
$HTTP["host"] == "domain.net" {
$HTTP["scheme"] == "https" {
setenv.add-response-header = ("Strict-Transport-Security" => "max-age=31536000; includeSubDomains")
}
}
Информация по HSTS доступна на Wikipedia.

Комментариев нет:

Отправить комментарий