From: Jacob Champion Date: Mon, 22 Aug 2016 21:27:19 +0000 (+0000) Subject: docs: rebuild X-Git-Tag: 2.5.0-alpha~1216 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d1e464ca8b6b3d189f99b9e37b9d7f3918daff88;p=thirdparty%2Fapache%2Fhttpd.git docs: rebuild git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1757281 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/ssl/ssl_howto.html.en b/docs/manual/ssl/ssl_howto.html.en index 1c8ff75f3dc..a0c9ce32ce5 100644 --- a/docs/manual/ssl/ssl_howto.html.en +++ b/docs/manual/ssl/ssl_howto.html.en @@ -34,7 +34,7 @@ documentation, and arrive at a deeper understanding of the material, before progressing to the advanced techniques.

top
-

Cipher Suites and Enforcing Strong Security

+

Cipher Suites and Enforcing Strong Encryption

+ + +
+

"Strong encryption" is, and has always been, a moving target. Furthermore, +the definition of "strong" depends on your desired use cases, your threat +models, and your acceptable levels of risk. The Apache HTTP Server team cannot +determine these things for you.

+

For the purposes of this document, which was last updated in mid-2016, +"strong encryption" refers to a TLS implementation which provides all of the +following, in addition to the basic confidentiality, integrity, and authenticity +protection that most users already expect:

+
    +
  • Perfect Forward Secrecy, which ensures that a compromise to a server's +private key in the present does not compromise the confidentiality of past TLS +communication.
    • +
  • Protection from known attacks on older SSL and TLS implementations, such +as POODLE and +BEAST.
    • +
  • Support for the strongest ciphers available to modern (and up-to-date) web +browsers and other HTTP clients.
    • +
  • Rejection of clients that cannot meet these requirements. +In other words, "strong encryption" requires that out-of-date clients be +completely unable to connect to the server, to prevent them from endangering +their users. Whether or not this is appropriate for your situation is a decision +that only you can make.
    • +
+

Please note that strong encryption does not, by itself, ensure +strong security. (As an example, HTTP compression oracle attacks such +as BREACH +may require further steps to mitigate.)

+

How can I create an SSL server which accepts strong encryption only?

-

The following enables only the strongest ciphers:

- 
SSLCipherSuite HIGH:!aNULL:!MD5
- - -

While with the following configuration you specify a preference - for specific speed-optimized ciphers (which will be selected by - mod_ssl, provided that they are supported by the client):

- - 
SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
-SSLHonorCipherOrder on
- - - -

How can I create an SSL server which accepts all types of ciphers -in general, but requires a strong ciphers for access to a particular -URL?

+

The following configuration enables "strong encryption", as defined + above, and is derived from the Mozilla Foundation's + Server Side + TLS requirements:

+ + 
# "Modern" configuration, defined by the Mozilla Foundation's SSL Configuration
+# Generator as of August 2016. This tool is available at
+# https://mozilla.github.io/server-side-tls/ssl-config-generator/
+SSLProtocol         all -SSLv3 -TLSv1 -TLSv1.1
+# Many ciphers defined here require a modern version (1.0.1+) of OpenSSL. Some
+# require OpenSSL 1.1.0, which as of this writing was in pre-release.
+SSLCipherSuite      ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
+SSLHonorCipherOrder on
+SSLCompression      off
+SSLSessionTickets   off
+ + + + +

The exact ciphersuites supported in the + SSLCipherSuite line are determined + by your OpenSSL installation, not the server. You may need to upgrade to a + modern version of OpenSSL in order to use them.

+ + +

How can I create an SSL server which accepts many types of ciphers +in general, but requires a strong cipher for access to a particular URL?

Obviously, a server-wide SSLCipherSuite which restricts ciphers to the strong variants, isn't the answer here. However, @@ -92,13 +150,13 @@ URL? blocks, to give a per-directory solution, and can automatically force a renegotiation of the SSL parameters to meet the new configuration. This can be done as follows:

- 
# be liberal in general
-SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL
+    
# be liberal in general -- use Mozilla's "Intermediate" ciphersuites (weaker
+# ciphersuites may also be used, but will not be documented here)
+SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
 
 <Location "/strong/area">
-# but https://hostname/strong/area/ and below
-# requires strong ciphers
-SSLCipherSuite HIGH:!aNULL:!MD5
+# but https://hostname/strong/area/ and below requires strong ciphersuites
+SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
 </Location>