https_apache.md

Mise en place du https
============================================

Module apache à activer :
```bash
    a2enmod ssl
```

A modifier :

```
    SSLCertificateFile /etc/ssl/certs/fullchain.pem
    SSLCertificateKeyFile /etc/ssl/private/privkey.pem
```


Vhost https: 

```apache
  <IfModule mod_ssl.c>
     <VirtualHost *:443>
     
### identité vhost     
        DocumentRoot /var/www/html/MaarchCourrier/
        ServerName xxxx.site.com
### fin identité vhost

### SSL engine
        SSLEngine on
        
            #A modifier en fonction du besoin client
        SSLCertificateFile /etc/ssl/certs/fullchain.pem
        SSLCertificateKeyFile /etc/ssl/private/privkey.pem 
            ########################################
            
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
        </Directory>
### Fin ssl

### Vhost maarch
        <Directory /var/www/html/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Require all granted
        </Directory>
        <Directory "/var/www/html/MaarchCourrier">
            AllowOverride All
            Options -Indexes
            Options FollowSymLinks Includes ExecCGI
            #Chemin vers le dossier temporaire
            SetEnv MAARCH_TMP_DIR "/tmp/"

            #Clé de chiffrement des mdp. A MODIFIER
            SetEnv MAARCH_ENCRYPT_KEY "Security Key Maarch Courrier 2008"
            <FilesMatch ".*">
                Order deny,allow
                Deny from all
            </FilesMatch>
            # Root to allow index.php
            <FilesMatch "^$">
                Order allow,deny
                Allow from all
            </FilesMatch>
            # Core root
            <FilesMatch "^(index|ws_server|static|merged_js|merged_css|reopen|applet_launcher|applet_controller|log)\.php$">
                Order allow,deny
                Allow from all
            </FilesMatch>
            # App static files
            <FilesMatch "\.(css|js|jpg|jpeg|png|gif|ttf|woff|woff2|svg)$">
                Order allow,deny
                Allow from all
            </FilesMatch>
            # App tools files
            <FilesMatch "\.(htm|html|jar|jnlp)$">
                Order allow,deny
                Allow from all
            </FilesMatch>
        </Directory>
### fin vhost maarch
      </VirtualHost>
  </IfModule>
  ```


##Vérification de l'intégrité des certificat : 
  
    openssl s_client -connect example.com:443 

## ajouter un certificat manuellement 

    sudo mkdir /usr/local/share/ca-certificates/extra
    sudo cp root.cert.pem /usr/local/share/ca-certificates/extra/root.cert.crt
    sudo update-ca-certificates