Apache SSL

August 22, 2026 ยท View on GitHub

Available entropy

cat /proc/sys/kernel/random/entropy_avail

Edit mods-enabled/ssl.conf

https://docs.tlsref.org/server-side-tls.html

  • ECDSA certificate Speed!
  • Entropy source Speed!
  • Protocol TLS1.3 Speed!
  • Ciphersuites AES-NI Speed!
  • SSL session cache Speed!
  • OCSP stapling Speed!
  • SNI
  • HSTS
  • HTTP/2 Speed!

https://istlsfastyet.com/

Current master in Debian

See /webserver/apache-conf-available/ssl-tlsref-modern.default

Installing CA on a server

See /security/ca/README.md

Client certificate authentication

SSLCACertificateFile /etc/ssl/localcerts/company-ca.pem
<Location /auth>
    SSLVerifyClient require
</Location>

    // Check verification result, CA and client CN
    $verified = (
        array_key_exists( 'SSL_CLIENT_VERIFY', $_SERVER )
        && 'SUCCESS' === $_SERVER['SSL_CLIENT_VERIFY']
        && array_key_exists( 'SSL_CLIENT_I_DN', $_SERVER )
        && $client_issuer_dn === $_SERVER['SSL_CLIENT_I_DN']
        && array_key_exists( 'SSL_CLIENT_S_DN', $_SERVER )
        && in_array( $_SERVER['SSL_CLIENT_S_DN'], $ok_client_dns )
    );

Sending client certificate to iOS devices

  • Import to be exported client certificates
  • Download IPCU
  • Extract .msi packages
  • Install AppleApplicationSupport.msi and AppleMobileDeviceSupport64.msi and iPhoneConfigUtility.msi
  • copy "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\SQLite3.dll" "C:\Program Files (x86)\iPhone Configuration Utility\"

DH parameters

https://weakdh.org/sysadmin.html

HTTP/2, SPDY

Tests

Moving to HTTPS

Search & Replace URL-s.

  • Set CDN to HTTP/HTTPS
  • Database
  • Local files
  • Inbound links on other websites
  • Analytics does not detect referer on redirection

Clear HSTS settings

http://classically.me/blogs/how-clear-hsts-settings-major-browsers