X-Git-Url: https://git.ralfj.de/ansible.git/blobdiff_plain/9a2be3a8496bdf04794c14d84aa3a5017c8fb8db..9892b8db62a259be7669e04257d25e54a687a8b1:/roles/apache/templates/ssl.conf?ds=inline

diff --git a/roles/apache/templates/ssl.conf b/roles/apache/templates/ssl.conf
index bb80746..5fa87c3 100644
--- a/roles/apache/templates/ssl.conf
+++ b/roles/apache/templates/ssl.conf
@@ -17,7 +17,7 @@
     Header unset Strict-Transport-Security
     Header set Strict-Transport-Security "max-age=864000"
     # Make sure we load everything via HTTPS
-    Header set Content-Security-Policy "upgrade-insecure-requests"
+    Header add Content-Security-Policy "upgrade-insecure-requests"
 
     #########################################################
     # SSL configuration below ###############################
@@ -33,8 +33,11 @@
     SSLCipherSuite 'kEECDH+AESGCM:kEDH+AESGCM:kEECDH:kEDH:AESGCM:ALL:!3DES:!EXPORT:!LOW:!MEDIUM:!aNULL:!eNULL'
     SSLHonorCipherOrder     on
 
-    #   Certificate, DH parameters and key
-    SSLCertificateFile    /etc/ssl/mycerts/$cert.crt+dh
+    # DH parameters
+    SSLOpenSSLConfCmd DHParameters "/etc/ssl/dh2048.pem"
+
+    #   Certificate and key
+    SSLCertificateFile    /etc/ssl/mycerts/$cert.crt
     SSLCertificateKeyFile /etc/ssl/private/$cert.key
 
     #   Server Certificate Chain:
@@ -44,7 +47,7 @@
     #   the referenced file can be the same as SSLCertificateFile
     #   when the CA certificates are directly appended to the server
     #   certificate for convinience.
-    SSLCertificateChainFile /etc/ssl/mycerts/$cert.chain
+    SSLCertificateChainFile /etc/ssl/mycerts/$cert.crt
 
     #   Certificate Authority (CA):
     #   Set the CA certificate verification path where to find CA