将Apache从2.4.18升级到2.4.46后获取内部服务器错误
最近将Apache从2.4.18升级到2.4.46。我正在运行Ubuntu 16.04，Apache设置为SSL反向代理。升级之前，安装程序运行正常。升级后，我得到的只是500个内部服务器错误，如下所示（LogLevel设置为debug）： Apache配置如下：将Apache从2.4.18升级到2.4.46后获取内部服务器错误,apache,ubuntu,ssl,reverse-proxy,Apache,Ubuntu,Ssl,Reverse Proxy,最近将Apache从2.4.18升级到2.4.46。我正在运行Ubuntu 16.04，Apache设置为SSL反向代理。升级之前，安装程序运行正常。升级后，我得到的只是500个内部服务器错误，如下所示（LogLevel设置为debug）： Apache配置如下： <IfModule mod_ssl.c> <VirtualHost *:10547> ServerAdmin webmaster@localhost
<IfModule mod_ssl.c>
<VirtualHost *:10547>
ServerAdmin webmaster@localhost
#DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/10547_error.log
#ErrorLog syslog:local6
CustomLog ${APACHE_LOG_DIR}/10547_access.log combined
# CustomLog "|/etc/apache2/sites-available/apache2_syslog_script" combined
LogFormat "\"%{%Y-%m-%d %H:%M:%S}t\" %a %V %m \"%U\" \"%q\" %{Content-Type}o %s %B %O %D" responsetime
CustomLog "/var/log/apache2/10547_responsetime.log" responsetime
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
#ModSecurity enabled
Include "/usr/share/modsecurity-crs/rules/*.conf"
<IfModule security2_module>
SecRuleEngine On
SecAuditEngine RelevantOnly
#SecAuditLog /var/log/apache2/modsec_audit.log
SecRequestBodyAccess On
SecAuditLogParts ABCFHJKZ
SecRuleRemoveById 920180
SecRuleRemoveById 920420
SecRuleRemoveById 920450
SecRuleRemoveById 954014
SecRuleRemoveById 920240
SecRuleRemoveById 920180
SecRuleRemoveById 920340
SecRuleRemoveByTag "LEAKAGE/ERRORS_IIS"
</IfModule>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/ssl/certs/hfgroup.co.ke.old.crt
SSLCertificateKeyFile /etc/ssl/private/hfgroup.co.ke.old.key
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyRequests Off
#ProxyPreserveHost On
ProxyPass /hfc/ProcessRequestServlet https://10.70.7.254:10547/hfc/ProcessRequestServlet
ProxyPassReverse /hfc/ProcessRequestServlet https://10.70.7.254:10547/hfc/ProcessRequestServlet
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
SSLCertificateChainFile /etc/ssl/certs/PKCS7.cer
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
# BrowserMatch "MSIE [2-6]" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
</VirtualHost>
<VirtualHost *:10549>
ServerAdmin webmaster@localhost
#DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
LogLevel debug
ErrorLog ${APACHE_LOG_DIR}/10549_error.log
#ErrorLog syslog:local6
CustomLog ${APACHE_LOG_DIR}/10549_access.log combined
# CustomLog "|/etc/apache2/sites-available/apache2_syslog_script" combined
LogFormat "\"%{%Y-%m-%d %H:%M:%S}t\" %a %V %m \"%U\" \"%q\" %{Content-Type}o %s %B %O %D" responsetime
CustomLog "/var/log/apache2/10549_responsetime.log" responsetime
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
#ModSecurity enabled
Include "/usr/share/modsecurity-crs/rules/*.conf"
<IfModule security2_module>
SecRuleEngine On
SecAuditEngine RelevantOnly
#SecAuditLog /var/log/apache2/modsec_audit.log
SecRequestBodyAccess On
SecAuditLogParts ABCFHJKZ
SecRuleRemoveById 920180
SecRuleRemoveById 920420
SecRuleRemoveById 920450
SecRuleRemoveById 954014
SecRuleRemoveById 920240
SecRuleRemoveById 920180
SecRuleRemoveById 920340
SecRuleRemoveByTag "LEAKAGE/ERRORS_IIS"
</IfModule>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/ssl/certs/hfgroup.co.ke.cer
SSLCertificateKeyFile /etc/ssl/private/hfgroup.co.ke.key
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyRequests Off
#ProxyPreserveHost On
ProxyPass /hfc/ProcessRequestServlet https://10.70.7.252:10549/hfc/ProcessRequestServlet
ProxyPassReverse /hfc/ProcessRequestServlet https://10.70.7.252:10549/hfc/ProcessRequestServlet
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
SSLCertificateChainFile /etc/ssl/certs/PKCS7.cer
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
# BrowserMatch "MSIE [2-6]" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
</VirtualHost>
</IfModule>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
服务器管理员webmaster@localhost
#DocumentRoot/var/www/html
#可用日志级别：trace8、…、trace1、调试、信息、通知、警告、，
#错误、暴击、警报、紧急情况。
#还可以为特定应用程序配置日志级别
#模块，例如。
#日志级别信息ssl:警告
ErrorLog${APACHE_LOG_DIR}/10547_error.LOG
#ErrorLog syslog:local6
CustomLog${APACHE_LOG_DIR}/10547_access.LOG组合
#CustomLog“|/etc/apache2/sites available/apache2_syslog_script”组合
日志格式“\”%{%Y-%m-%d%H:%m:%S}t\%a%V%m\%U\“\%q\”%{Content Type}o%S%B%o%d”响应时间
CustomLog“/var/log/apache2/10547_responsetime.log”responsetime
#对于conf/available/中的大多数配置文件
#在全局级别启用或禁用，可以
#仅包含一个特定虚拟主机的行。例如
#以下行仅为此主机启用CGI配置
#在使用“A2F”全局禁用后。
#包括conf available/service-cgi-bin.conf
#ModSecurity已启用
包括“/usr/share/modsecurity-crs/rules/*.conf”
SecRuleEngine打开
SecAuditEngine仅与此相关
#SecAuditLog/var/log/apache2/modsec_audit.log
SecRequestBodyAccess On
SecAuditLogParts ABCFHJKZ
SecRuleRemoveById 920180
SecRuleRemoveById 920420
SecRuleRemoveById 920450
SecRuleRemoveById 954014
SecRuleRemoveById 920240
SecRuleRemoveById 920180
SecRuleRemoveById 920340
SecRuleRemoveByTag“泄漏/错误\u IIS”
#SSL引擎交换机：
#为此虚拟主机启用/禁用SSL。
斯伦金安
#通过安装，可以创建自签名（snakeoil）证书
#ssl证书包。看见
#/usr/share/doc/apache2/README.Debian.gz了解更多信息。
#如果密钥和证书都存储在同一个文件中，则只有
#需要SSLCertificateFile指令。
SSLCertificateFile/etc/ssl/certs/hfgroup.co.ke.old.crt
SSLCertificateKeyFile/etc/ssl/private/hfgroup.co.ke.old.key
SSLProxyEngine打开
SSLProxyVerify无
SSLProxyCheckPeerCN关闭
SSLProxyCheckPeerName关闭
SSLProxycheckpeer关闭
代理请求关闭
#代理主机
ProxyPass/hfc/ProcessRequestServlethttps://10.70.7.254:10547/hfc/ProcessRequestServlet
ProxyPassReverse/hfc/ProcessRequestServlethttps://10.70.7.254:10547/hfc/ProcessRequestServlet
#服务器证书链：
#将SSLCertificateChainFile指向包含
#PEM编码CA证书的串联，这些证书构成
#服务器证书的证书链。或者
#引用的文件可以与SSLCertificateFile相同
#将CA证书直接附加到服务器时
#方便证书。
SSLCertificateChainFile/etc/ssl/certs/PKCS7.cer
#证书颁发机构（CA）：
#设置要查找CA的CA证书验证路径
#用于客户端身份验证的证书，或者一个
#包含所有这些内容的大型文件（文件必须是PEM编码的）
#注意：在SSLCACertificatePath中，您需要哈希符号链接
#指向证书文件。使用提供的
#Makefile在更改后更新哈希符号链接。
#SSLCACertificatePath/etc/ssl/certs/
#SSLCACertificateFile/etc/apache2/ssl.crt/ca-bundle.crt
#证书吊销列表（CRL）：
#设置要在其中查找客户端的CA CRL的CA吊销路径
#身份验证，或者一个包含所有
#其中（文件必须为PEM编码）
#注意：在sslcareconcationpath中，您需要哈希符号链接
#指向证书文件。使用提供的
#Makefile在更改后更新哈希符号链接。
#sslcavocationpath/etc/apache2/ssl.crl/
#sslcaverocationfile/etc/apache2/ssl.crl/ca-bundle.crl
#客户端身份验证（类型）：
#客户端证书验证类型和深度。类型是
#无、可选、必需和可选。深度为
#指定证书验证深度的数字
#确定证书无效之前的颁发者链。
#SSLVerifyClient要求
#SSLVerifyDepth 10
#SSL引擎选项：
#设置各种选项
<IfModule mod_ssl.c>
<VirtualHost *:10547>
ServerAdmin webmaster@localhost
#DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/10547_error.log
#ErrorLog syslog:local6
CustomLog ${APACHE_LOG_DIR}/10547_access.log combined
# CustomLog "|/etc/apache2/sites-available/apache2_syslog_script" combined
LogFormat "\"%{%Y-%m-%d %H:%M:%S}t\" %a %V %m \"%U\" \"%q\" %{Content-Type}o %s %B %O %D" responsetime
CustomLog "/var/log/apache2/10547_responsetime.log" responsetime
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
#ModSecurity enabled
Include "/usr/share/modsecurity-crs/rules/*.conf"
<IfModule security2_module>
SecRuleEngine On
SecAuditEngine RelevantOnly
#SecAuditLog /var/log/apache2/modsec_audit.log
SecRequestBodyAccess On
SecAuditLogParts ABCFHJKZ
SecRuleRemoveById 920180
SecRuleRemoveById 920420
SecRuleRemoveById 920450
SecRuleRemoveById 954014
SecRuleRemoveById 920240
SecRuleRemoveById 920180
SecRuleRemoveById 920340
SecRuleRemoveByTag "LEAKAGE/ERRORS_IIS"
</IfModule>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/ssl/certs/hfgroup.co.ke.old.crt
SSLCertificateKeyFile /etc/ssl/private/hfgroup.co.ke.old.key
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyRequests Off
#ProxyPreserveHost On
ProxyPass /hfc/ProcessRequestServlet https://10.70.7.254:10547/hfc/ProcessRequestServlet
ProxyPassReverse /hfc/ProcessRequestServlet https://10.70.7.254:10547/hfc/ProcessRequestServlet
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
SSLCertificateChainFile /etc/ssl/certs/PKCS7.cer
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
# BrowserMatch "MSIE [2-6]" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
</VirtualHost>
<VirtualHost *:10549>
ServerAdmin webmaster@localhost
#DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
LogLevel debug
ErrorLog ${APACHE_LOG_DIR}/10549_error.log
#ErrorLog syslog:local6
CustomLog ${APACHE_LOG_DIR}/10549_access.log combined
# CustomLog "|/etc/apache2/sites-available/apache2_syslog_script" combined
LogFormat "\"%{%Y-%m-%d %H:%M:%S}t\" %a %V %m \"%U\" \"%q\" %{Content-Type}o %s %B %O %D" responsetime
CustomLog "/var/log/apache2/10549_responsetime.log" responsetime
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
#ModSecurity enabled
Include "/usr/share/modsecurity-crs/rules/*.conf"
<IfModule security2_module>
SecRuleEngine On
SecAuditEngine RelevantOnly
#SecAuditLog /var/log/apache2/modsec_audit.log
SecRequestBodyAccess On
SecAuditLogParts ABCFHJKZ
SecRuleRemoveById 920180
SecRuleRemoveById 920420
SecRuleRemoveById 920450
SecRuleRemoveById 954014
SecRuleRemoveById 920240
SecRuleRemoveById 920180
SecRuleRemoveById 920340
SecRuleRemoveByTag "LEAKAGE/ERRORS_IIS"
</IfModule>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/ssl/certs/hfgroup.co.ke.cer
SSLCertificateKeyFile /etc/ssl/private/hfgroup.co.ke.key
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyRequests Off
#ProxyPreserveHost On
ProxyPass /hfc/ProcessRequestServlet https://10.70.7.252:10549/hfc/ProcessRequestServlet
ProxyPassReverse /hfc/ProcessRequestServlet https://10.70.7.252:10549/hfc/ProcessRequestServlet
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
SSLCertificateChainFile /etc/ssl/certs/PKCS7.cer
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
# BrowserMatch "MSIE [2-6]" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
</VirtualHost>
</IfModule>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet