In the last lesson of the previous performance section of this course we generated some self scientific
ads and sure how to an able SSL connections.
That said our implementation was just about as basic as it can get and yielded nothing more than a default.
H T T P S connection in this lesson then the first of the new security section will continue with that
SSL configuration by discussing a few key SSL specific configuration directives and see how to optimize
our HTP s connections before we begin.
However I'll just remove this index stock patch p value from the index directive allowing us to access
that demo site from the root you are.
And to keep things simple.
I'll also remove these Bush directives keeping the htb to connection however save this.
Reload the engine configuration and check this is working as expected in the browser by removing this
index dot htl request.
You are right.
And that works.
We get the demo side loading from the root you are L..
Step 1 then when dealing with an H T T P S request is providing some or other fallback or handler for
insecure HTP connections at the moment we have H T T P S specified in the request but should I remove
this.
Making this request.
H T T P.
We get a connection error.
This being as the request is going to our IP address on port 80 for HTP and our server not having any
lesson directives on port 80 to prevent this from happening then we have two options.
Number one is to also listen on port 80 or in other words making our server available over an insecure
connection.
Now whilst this might have been fine just a couple of years ago htb s has become a standard and really
there's no legitimate reason to use HTP any longer.
And on top of security and search engine optimization reasons you'll also sacrifice the added performance
of HTP too as it's only available over SSL option number two then.
And by far the best option is to redirect all hgt requests to the equivalent HTP s request.
There's a few ways of achieving this but again the most reliable and easiest is going to be creating
a dedicated virtual host or server context in the h.t. dbe context.
Then I'll add a new server which listens on port 80.
So HTP with this same server name as we're listening on the same IP or domain.
I'll copy this and all the server needs to do regardless if the request is redirect with a 3 0 1 status
code which is moved permanently to HTP s.
So port for Forth 3 server name being this variable.
But this can also be host as the request host must be this IP or even a hard coded domain or IP as we
have a year.
All the same I'll stick to a host as it's the most descriptive and the request.
You are right.
That's it.
Save this reload configuration refresh this HTP request and this time we get redirected to the H T T
P S equivalent.
So everything works.
We can also double check this on the command line call their headers.
Allowing that self science to difficult.
H t D P and the server I b enter and again 3 0 1 moved permanently redirecting to H T T P S So that's
our requests sorted and we can be assured that all requests will end up in this SSL server next then.
Let's see how to improve upon this as Al encryption and make our server more secure in the server context.
The first thing we'll do is disable S S L or more specifically the S S L protocol C whilst we still
refer to and write this as s s l the SSL protocol or secure sockets layer has been outdated and replaced
for the most part by the newer and better t o s or transport.
Lay a security protocol which to an able leaving the SSL protocol out we can do by specifying SSL protocols
t l s v one or Version 1 t l es version one point one and T O S version one point two there were hgt
be connections now being encrypted using t o s only.
Rather than the older s s l protocol.
Next we can set which cipher suite should be used by the t o s protocol to encrypt our connection.
First we need to tell engine X that we are going to do this by setting the SSL prefer Servat siphesihle
directive 2 on then using the SSL scifres directive.
We can set a string of suites to use and ones which should not be used.
Like so each suite year being separated by a colon and the want not to use being prefixed with an exclamation
like this simple m.d..
5.
Sweet.
Now the selection of preferred cipher suite isn't a very definite selection and you'll most likely find
a number of these combinations on the Internet.
This one here is very solid but might also become outdated as some of these suites become vulnerable
due to exploits etc..
Feel free to use this combination.
Or alternatively a quick search will provide some up to date combinations.
Just make sure you get your preferred sweet combination from a reputable source.
Next with our cipher suites optimized will enable diffie hellman key exchange or in short d h parameters
how this works is far beyond the scope of this course but basically having D.
Parameters in abled allows your server to perform key exchanges meaning between the client and the server
with perfect secrecy.
I've linked to a couple of in-depth articles in the list and resources.
Should you want to find out how this works exactly.
But a very good addition to any hgt be a server then to enable the age parameters we can add SSL underscored.
D h.
Paran and specify where our generator d.h. parameters can be found.
We've not yet created these but I'll say slash it see slash engine X slash S S L So with those certificates
slash d h Paran dot P E M save this.
But before we can reload in generics let's generate those d parameters.
Again using the open SSL command line tools that we used earlier to generate our certificates say open
s s l d h per ram specifying the size which very importantly must match that of our private key as we
set it when generating the key.
So two thousand and forty eight writing this file out to that location we specified in the engine X
configuration slash C slash engine X slash s s l d h boram Dot P E M enter and as per this message this
can take a few minutes to complete.
I'll just fast forward and done.
List the contents of that SSL directory and there we have it.
Meaning we should now be able to reload this configuration without any errors reload of form a call
request again and everything works.
Back to the configuration and the next.
Very simple configuration to improve an exclusively SSL enabled side is enabling h s t s or strict transport
security.
This is a header that tells the browser not to load anything of HDD.
Be meaning we can minimize redirects from Port 80 to board for 4 3.
Just a very small but valuable tweak add a header with the name strict transport security.
And the value of Max age equals one year in seconds.
Always.
Next we can enable a simple cash for our SSL sessions.
If you recall from a previous lesson I mentioned that the SSL connection involves a handshake between
the client and the server in order to be able to read each other's encrypted data.
This session cash then allows the server to cash those handshakes for a set amount of time.
Thus improving SSL connection times so to configure a session cache zone say SSL session cash the default
cashed I've been bowled in but this is limited to a specific worker process and really not very useful.
So instead then we'll set this to a cash type of shared meaning the session cash is kept in memory and
can be accessed by any worker process.
A much better option.
If there's memory zone and name s s l and a size Auty Meg should be ample for most sites worth an S
S L session time out meaning how long to keep a session cashed for off for hours.
Again this not being a strict setting but four hours provides a decent amount of time for returning
users.
And lastly in order to use this session cache with out actually having the server access the cache we
can enable.
S s l.
Session tickets.
This basically means provide the browser with a ticket which validates the SSL session.
This ticket is issued by the server so it's trusted and allows us to bypass reading from the session
cache.
It does however mean we can disable the memory cache as we cannot be sure the client holds a ticket
but it optimize server resources in reducing SSL session lookups that covers the very most important
parts of fine tuning and optimizing your SSL connection.
So let's make sure this is all still working before finishing up.
Save all this check the current configuration for any errors.
Everything is fine reload and when I perform a call request we get that expected indexed.
HDL page over an optimized HTP connection.