From f9afafeddb8bb96723f9c9251883e9582a06a956 Mon Sep 17 00:00:00 2001 From: Mirko Tietgen Date: Thu, 31 Dec 2015 11:52:13 +0100 Subject: [PATCH] Bug 15303 Go back to old version of Apache template This version of the Apache template is less sophisticated, but should work with Apache 2.2 and 2.4. SSL options are commented out (#) in the beginning, ports are set to 80. When the certificated are available, ports are changed to 443, all # are removed for SSL options and HTTP redirect. --- debian/scripts/koha-create | 5 +-- debian/templates/apache-site-https.conf.in | 50 +++++++++++++--------------- 2 files changed, 26 insertions(+), 29 deletions(-) diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create index 5cce7dc..27b5d8a 100755 --- a/debian/scripts/koha-create +++ b/debian/scripts/koha-create @@ -738,12 +738,13 @@ then if [ "$USE_HTTPS" = "yes" ]; then # Get letsencrypt certificates - # TODO: fix path of letsencrypt $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain # enable all ssl settings (apache won't start with these before certs are present) - sed -i "s:^\s*\(<.*IfDefine.*> #https\)$:# \1:" "/etc/apache2/sites-available/$name.conf" + sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" # change port from 80 to 443. (apache won't start if it is 443 without certs present) sed -i "s:^\s*\( #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # enable redirect from http to https on port 80 + sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf" # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead touch $libdir/$instancename/letsencrypt.enabled # restart apache with working certs diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in index f2bac01..a5c28f0 100644 --- a/debian/templates/apache-site-https.conf.in +++ b/debian/templates/apache-site-https.conf.in @@ -1,25 +1,22 @@ # Koha instance __KOHASITE__ Apache config. - #https - - RewriteEngine On - RewriteCond %{HTTPS} !=on - RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] - - #https +# redirect http to https +# #nohttps +# RewriteEngine On #nohttps +# RewriteCond %{HTTPS} !=on #nohttps +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps +# #nohttps # OPAC #https - #https - SSLEngine on - SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 - SSLCompression off - SSLHonorCipherOrder on - SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" - SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem - SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem - SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem - #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA- +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem = 2.4> Define instance "__KOHASITE__" @@ -42,16 +39,15 @@ # Intranet #https - #https - SSLEngine on - SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 - SSLCompression off - SSLHonorCipherOrder on - SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" - SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem - SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem - SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem - #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + = 2.4> Define instance "__KOHASITE__" -- 1.7.10.4