blob: d09a06b69e82d128098b3f0cc80b79390744f43e (
plain)
- GnuTLSEnable on
- # based on <https://blog.joelj.org/ecdsa-certificates-with-apache-2-4-lets-encrypt/>
- # * only strong EC crypto suites supporting Perfect Forward Secrecy
- # * supported by all SNI-capable browsers
- # Options:
- # * drop %SAFE_RENEGOTIATION for Safari 5.1.9 / OS X 10.6.8 support
- # * add 3DES-CBS after AES-128-CBC for Android 2.3.7 support on non-SNI hosts
- # * add CHACHA20-POLY1305 after ECDHE-ECDSA with libgnutls >= 3.4.0
- GnuTLSPriorities NONE:+ECDHE-ECDSA:+AES-256-GCM:+AES-128-GCM:+AES-256-CBC:+AES-128-CBC:+AEAD:+SHA384:+SHA256:+SHA1:+CTYPE-X509:+VERS-TLS-ALL:-VERS-SSL3.0:+COMP-NULL:+CURVE-SECP384R1:+SIGN-ECDSA-SHA512:+SIGN-ECDSA-SHA384:+SIGN-ECDSA-SHA256:+SIGN-ECDSA-SHA224:%SERVER_PRECEDENCE:%SAFE_RENEGOTIATION
- GnuTLSCertificateFile /etc/ssl/certs/apache2+cacert.org.pem
- GnuTLSKeyFile /etc/ssl/private/apache2.pem
- # HSTS: http://www.debian-administration.org/articles/662
- Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
|
