Apache 2.2系(CentOS6)とApache2.4系(CentOS7)のSSL証明書設定の違い

大きな違い

Apache2.4系ではSSLCertificateChainFileがない。

※クロスルート証明書を設定すると、不特定多数のユーザからのアクセスを望む場合は、ユーザのクライアント環境が古い場合にアクセスできない場合があります。

証明書の設定の違い

Apache2.2系(2.2~2.4.7)

SSLCertificateKeyFile – 秘密鍵
SSLCertificateFile – サーバ証明書
SSLCertificateChainFile – 上：中間CA証明書、下：クロスルート証明書

Apache2.4系(2.4.7~2.4.8以降)

SSLCertificateKeyFile – 秘密鍵
SSLCertificateFile – 上：サーバ証明書、中：中間CA証明書、下：クロスルート証明書

設定の違い

Apache2.2系(2.2~2.4.7)

# grep -v -e '^#' -e '^;' -e '^$' /etc/httpd/conf.d/ssl.conf


LoadModule ssl_module modules/mod_ssl.so
Listen 443
SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin



<VirtualHost _default_:443>
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>

<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

Apache2.4系(2.4.7~2.4.8以降)

# grep -v -e '^#' -e '^;' -e '^$' /etc/httpd/conf.d/ssl.conf


Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin



<VirtualHost _default_:443>
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key


<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>


<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

@see https://qiita.com/bageljp@github/items/6b9876b7571852284ead
@see https://knowledge.symantec.com/jp/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=SO28069