fix apache HTTP2HTTPS redirect config

[ansible.git] / roles / apache / templates / ssl.conf

diff --git a/roles/apache/templates/ssl.conf b/roles/apache/templates/ssl.conf
index bb807463db16fb510516f38a22d29ba4787b69ed..6a0b99f021e2c657cfd00508c118c9f17290f1ef 100644 (file)
--- a/roles/apache/templates/ssl.conf
+++ b/roles/apache/templates/ssl.conf
@@ -6,7 +6,14 @@
 <Macro HTTP2HTTPS $domain>
     <VirtualHost *:80>
         ServerName $domain
 <Macro HTTP2HTTPS $domain>
     <VirtualHost *:80>
         ServerName $domain

-        Redirect permanent / https://$domain/
+        # Apparently you need the rewrite engine to implement
+        # a simple "redirect all except for..." policy. Amazing.
+        RewriteEngine on
+        # Do *not* redirect the acme-challenge dir to https, since otherwise the
+        # challenge cannot be fetched when there is no certificate yet for this domain.
+        RewriteRule ^/\.well-known/acme-challenge/(.*) /srv/acme-challenge/$1 [L]
+        # Make the upgrade to HTTPS a "permanent" redirect.
+        RewriteRule ^/(.*) https://$domain/$1 [R=301,L]

     </VirtualHost>
 </Macro>
 
     </VirtualHost>
 </Macro>
 


@@ -17,7 +24,7 @@
     Header unset Strict-Transport-Security
     Header set Strict-Transport-Security "max-age=864000"
     # Make sure we load everything via HTTPS
     Header unset Strict-Transport-Security
     Header set Strict-Transport-Security "max-age=864000"
     # Make sure we load everything via HTTPS

-    Header set Content-Security-Policy "upgrade-insecure-requests"
+    Header add Content-Security-Policy "upgrade-insecure-requests"

 
     #########################################################
     # SSL configuration below ###############################
 
     #########################################################
     # SSL configuration below ###############################


@@ -33,8 +40,11 @@
     SSLCipherSuite 'kEECDH+AESGCM:kEDH+AESGCM:kEECDH:kEDH:AESGCM:ALL:!3DES:!EXPORT:!LOW:!MEDIUM:!aNULL:!eNULL'
     SSLHonorCipherOrder     on
 
     SSLCipherSuite 'kEECDH+AESGCM:kEDH+AESGCM:kEECDH:kEDH:AESGCM:ALL:!3DES:!EXPORT:!LOW:!MEDIUM:!aNULL:!eNULL'
     SSLHonorCipherOrder     on
 

-    #   Certificate, DH parameters and key
-    SSLCertificateFile    /etc/ssl/mycerts/$cert.crt+dh
+    # DH parameters
+    SSLOpenSSLConfCmd DHParameters "/etc/ssl/dh2048.pem"
+
+    #   Certificate and key
+    SSLCertificateFile    /etc/ssl/mycerts/$cert.crt

     SSLCertificateKeyFile /etc/ssl/private/$cert.key
 
     #   Server Certificate Chain:
     SSLCertificateKeyFile /etc/ssl/private/$cert.key
 
     #   Server Certificate Chain:


@@ -44,7 +54,7 @@
     #   the referenced file can be the same as SSLCertificateFile
     #   when the CA certificates are directly appended to the server
     #   certificate for convinience.
     #   the referenced file can be the same as SSLCertificateFile
     #   when the CA certificates are directly appended to the server
     #   certificate for convinience.

-    SSLCertificateChainFile /etc/ssl/mycerts/$cert.chain
+    SSLCertificateChainFile /etc/ssl/mycerts/$cert.crt

 
     #   Certificate Authority (CA):
     #   Set the CA certificate verification path where to find CA
 
     #   Certificate Authority (CA):
     #   Set the CA certificate verification path where to find CA