630d09f6c4
Generate the certificate to be used for koji in make-certs.sh by the same CA that also generates the composer and client certs. Create a single certificate that uses the SubjectAltName (SAN) extension to cover two domains: localhost, org.osbuild.koji.koji, which previously was done via two separate certificates; this is the legacy usage which stopped working with go 1.15 (see previous commit). As a consequence the apache config is modified to use only one virtual host with a ServerAlias directive.
47 lines
1.1 KiB
Text
47 lines
1.1 KiB
Text
Listen 443 https
|
|
|
|
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
|
|
|
|
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
|
|
SSLSessionCacheTimeout 300
|
|
|
|
SSLRandomSeed startup file:/dev/urandom 256
|
|
SSLRandomSeed connect builtin
|
|
SSLCryptoDevice builtin
|
|
|
|
## SSL Virtual Host Context
|
|
# localhost
|
|
<VirtualHost _default_:443>
|
|
ServerName localhost
|
|
ServerAlias org.osbuild.koji.koji
|
|
|
|
ErrorLog logs/ssl_error_log
|
|
TransferLog logs/ssl_access_log
|
|
LogLevel debug
|
|
|
|
|
|
SSLEngine on
|
|
SSLHonorCipherOrder on
|
|
SSLCipherSuite PROFILE=SYSTEM
|
|
SSLProxyCipherSuite PROFILE=SYSTEM
|
|
SSLCertificateFile /share/koji-crt.pem
|
|
SSLCertificateKeyFile /share/koji-key.pem
|
|
SSLCertificateChainFile /share/koji-ca.pem
|
|
SSLCACertificateFile /share/koji-ca.pem
|
|
SSLVerifyDepth 1
|
|
|
|
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
|
SSLOptions +StdEnvVars
|
|
</FilesMatch>
|
|
<Directory "/var/www/cgi-bin">
|
|
SSLOptions +StdEnvVars
|
|
</Directory>
|
|
|
|
BrowserMatch "MSIE [2-5]" \
|
|
nokeepalive ssl-unclean-shutdown \
|
|
downgrade-1.0 force-response-1.0
|
|
|
|
CustomLog logs/ssl_request_log \
|
|
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
|
</VirtualHost>
|