Borland VisiBroker® 7.0 - Borland Technical Publications

Security for the Apache web serverThe following describes the mod_ssl directives:SSLEngine onSSLRandomSeed startup builtinSSLRandomSeed connect builtinSSLCertificateFile /var/domains//configurations//mos//conf/ssl.crt/server.crtSSLCertificateKeyFile /var/domains//configurations//mos//conf/ssl.key/server.key## Uncomment the following to enable SSL certificate and related information tobe exported to the apache environment#SSLOptions +StdEnvVars +ExportCertDataWarningThe mod-ssl Apache module causes the Apache web server to become unstable whenused with the KeepAlive connection option on (the default). This is a known defect andusers should use caution after enabling the mod-ssl Apache module.Table 8.1 mod_ssl directivesSSL-specific directiveSSLEngineSSLRandomSeedSSLCertificateFileSSLCertificateKeyFileSSLOptions +StdEnvVars +ExportCertDataDescriptionThe placement of the SSLEngine is significant. It can be placed either at theserver level, in which case the server will respond only to HTTPS connections orwithin a particular virtual host, which can then be associated with a particularport number (usually 443), so that both regular HTTP connections and HTTPSconnections can be handled.Determines the source of randomness used by the mod_ssl encryption facilities.The randomness built into mod_ssl is sufficient to get you started, however, it isnot really random enough to be used in a truly secure environment. Preferably,a UNIX random device such as /dev/random or /dev/urandom is used. TheSSLRandomSeed directive must be defined at the server level.The placement of the SSLCertificateFile is significant. It can be placed either atthe server level, in which case the server will respond only to HTTPSconnections or within a particular virtual host, which can then be associated witha particular port number (usually 443), so that both regular HTTP connectionsand HTTPS connections can be handled. This file can be given any name andmay be placed in any accessible directory.The placement of the SSLCertificateKeyFile is significant. It can be placed eitherat the server level, in which case the server will respond only to HTTPSconnections or within a particular virtual host, which can then be associated witha particular port number (usually 443), so that both regular HTTP connectionsand HTTPS connections can be handled. This file can be given any name andmay be placed in any accessible directory.By default, commented out. If you want to enable Certificate Passthrough, youmust uncomment this directive which instructs mod_ssl to export the SSLcertificate and related information passed to it by the browser into a sharedenvironment.ImportantThe VisiBroker Server does not provide the key_file and certificate_file which mustbe generated. See “Creating key and certificate files” on page 79.For additional information on mod_ssl configuration, visit http://www.modssl.org/docs.78 VisiBroker Security Guide