@@ -, +, @@ --- debian/scripts/koha-create | 5 +-- debian/templates/apache-site-https.conf.in | 50 +++++++++++++--------------- 2 files changed, 26 insertions(+), 29 deletions(-) --- a/debian/scripts/koha-create +++ a/debian/scripts/koha-create @@ -738,12 +738,13 @@ then if [ "$USE_HTTPS" = "yes" ]; then # Get letsencrypt certificates - # TODO: fix path of letsencrypt $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain # enable all ssl settings (apache won't start with these before certs are present) - sed -i "s:^\s*\(<.*IfDefine.*> #https\)$:# \1:" "/etc/apache2/sites-available/$name.conf" + sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" # change port from 80 to 443. (apache won't start if it is 443 without certs present) sed -i "s:^\s*\( #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # enable redirect from http to https on port 80 + sed -i "s:^\s*#\(.*\)#nohttps$:\1:" "/etc/apache2/sites-available/$name.conf" # make koha-list --letsencrypt aware of this instance # could be done by checking apache conf instead touch $libdir/$instancename/letsencrypt.enabled # restart apache with working certs --- a/debian/templates/apache-site-https.conf.in +++ a/debian/templates/apache-site-https.conf.in @@ -1,25 +1,22 @@ # Koha instance __KOHASITE__ Apache config. - #https - - RewriteEngine On - RewriteCond %{HTTPS} !=on - RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] - - #https +# redirect http to https +# #nohttps +# RewriteEngine On #nohttps +# RewriteCond %{HTTPS} !=on #nohttps +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] #nohttps +# #nohttps # OPAC #https - #https - SSLEngine on - SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 - SSLCompression off - SSLHonorCipherOrder on - SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" - SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem - SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem - SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem - #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA- +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem = 2.4> Define instance "__KOHASITE__" @@ -42,16 +39,15 @@ # Intranet #https - #https - SSLEngine on - SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 - SSLCompression off - SSLHonorCipherOrder on - SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" - SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem - SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem - SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem - #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + = 2.4> Define instance "__KOHASITE__" --