Ubuntu Apache SSL配置

1. SSL協定類型設定

   • sudo vim /etc/apache2/mods-enabled/ssl.conf
   • [setting value]
     SSLHonorCipherOrder on
     SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!CBC:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE
     SSLProtocol -All -SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 （TLSv1非必要建議關掉，可提升安全性）

2. SSL證書配置

   • 產生
     sudo cp /usr/local/ssl/openssl.cnf ~
     vim openssl.cnf
     [setting value]
         [ req ] 底下加入 req_extensions = v3_req
         增加標籤 [ alt_names ] 並在底下加入
             DNS.1 = www.domian-a.com
             DNS.2 = www.domian-b.com
             DNS.3 = www.domian-c.com
     openssl req -new -key private.key -out hhs.csr -config openssl.cnf
   • 產生的hhs.csr向飛利浦IT提交
   • 安裝證書
     sudo mkdir /etc/ssl/SSL
     sudo unzip SSL.zip /etc/ssl/SSL/
     sudo vim /etc/apache2/sites-enabled/default-ssl.conf
     sudo cp “Path of PrivateKey” /etc/ssl/SSL/private.key
     [setting value]
         SSLCertificateFile /etc/ssl/HHS/ssl_certificate.crt
         SSLCertificateKeyFile /etc/ssl/HHS/private.key
         SSLCertificateChainFile /etc/ssl/HHS/IntermediateCA.crt
   • 重啓Apache
     sudo service apache2 restart