11 Enabling SSL for Oracle HTTP Server

11.4.1.1 SSLAccelerator

Specifies if SSL accelerator is used. Currently only nFast card is supported.

11.4.1.2 SSLCARevocationFile

Specifies the file where you can assemble the Certificate Revocation Lists (CRLs) from CAs (Certificate Authorities) that you accept certificates from. These are used for client authentication. Such a file is the concatenation of various PEM-encoded CRL files in order of preference. This directive can be used alternatively or additionally to SSLCARevocationPath.

11.4.1.3 SSLCARevocationPath

Specifies the directory where PEM-encoded Certificate Revocation Lists (CRLs) are stored. These CRLs come from the CAs (Certificate Authorities) that you accept certificates from. If a client attempts to authenticate itself with a certificate that is on one of these CRLs, then the certificate is revoked and the client cannot authenticate itself with your server.

11.4.1.4 SSLCipherSuite

Specifies the SSL cipher suite that the client can use during the SSL handshake. This directive uses a colon-separated cipher specification string to identify the cipher suite. Table 11-2 shows the tags you can use in the string to describe the cipher suite you want.

Tags are joined together with prefixes to form a cipher specification string.

11.4.1.5 SSLEngine

Toggles the usage of the SSL Protocol Engine. This is usually used inside a <VirtualHost> section to enable SSL for a particular virtual host. By default, the SSL Protocol Engine is disabled for both the main server and all configured virtual hosts. Example 11-1 is an example for using SSLEngine directive. The default SSL is 4443 on UNIX and 443 on Windows.

<VirtualHost_dafault_:4443>
  SSLEngine on
  ...
</VirtualHost>

11.4.1.6 SSLLog

Specifies where the SSL engine log file will be written. (Error messages will also be duplicated to the standard Oracle HTTP Server log file specified by the ErrorLog directive.)

Place this file at a location where only root can write, so that it cannot be used for symlink attacks. If the filename does not begin with a slash (/), it is assumed to be relative to the ServerRoot. If the filename begins with a bar (|), then the string following the bar is expected to be a path to an executable program to which a reliable pipe can be established.

This directive should occur only once per virtual server configuration.

11.4.1.7 SSLLogLevel

Specifies the verbosity degree of the SSL engine log file.

11.4.1.8 SSLMutex

Type of semaphore (lock) for SSL engine's mutual exclusion of operations that have to be synchronized between Oracle HTTP Server processes.

11.4.1.9 SSLOptions

Controls various runtime options on a per-directory basis. In general, if multiple options apply to a directory, the most comprehensive option is applied (options are not merged). However, if all of the options in an SSLOptions directive are preceded by a plus ('+') or minus ('-') symbol, then the options are merged. Options preceded by a plus are added to the options currently in force, and options preceded by a minus are removed from the options currently in force.

11.4.1.10 SSLPassPhraseDialog

Type of pass phrase dialog for wallet access. mod_ossl asks the administrator for a pass phrase in order to access the wallet.

11.4.1.11 SSLProtocol

Specifies SSL protocol(s) for mod_ossl to use when establishing the server environment. Clients can only connect with one of the specified protocols.

11.4.1.12 SSLRequire

Denies access unless an arbitrarily complex boolean expression is true.

The expression must match the following syntax (given as a BNF grammar notation):

expr ::= "true" | "false"
"!" expr
expr "&&" expr
expr "||" expr
"(" expr ")"

comp ::=word "==" word | word "eq" word
word "!=" word |word "ne" word
word "<" word |word "lt" word
word "<=" word |word "le" word
word ">" word |word "gt" word
word ">=" word |word "ge" word
word "=~" regex
word "!~" regex
wordlist ::= word
wordlist "," word

word ::= digit
cstring
variable
function

digit ::= [0-9]+

cstring ::= "..."

variable ::= "%{varname}"

Table 11-3 and Table 11-4 list standard and SSL variables. These are valid values for varname.

function ::= funcname "(" funcargs ")"

For funcname, the following function is available:

file(filename)

The file function takes one string argument, the filename, and expands to the contents of the file. This is useful for evaluating the file's contents against a regular expression.

Table 11-3 lists the standard variables for SSLRequire varname.

Table 11-4 lists the SSL variables for SSLRequire varname.

11.4.1.13 SSLRequireSSL

Denies access to clients not using SSL. This is a useful directive for absolute protection of a SSL-enabled virtual host or directories in which configuration errors could create security vulnerabilities.

11.4.1.14 SSLSessionCache

Specifies the global/interprocess session cache storage type. The cache provides an optional way to speed up parallel request processing.

11.4.1.15 SSLSessionCacheTimeout

Specifies the number of seconds before a SSL session in the session cache expires.

11.4.1.16 SSLVerifyClient

Specifies whether or not a client must present a certificate when connecting.

11.4.1.17 SSLWallet

Specifies the location of the wallet with its WRL.

11.4.1.18 SSLWalletPassword

Specifies the Wallet password needed to access the wallet specified within the same context. You can choose either a cleartext wallet password or an obfuscated password. The obfuscated password is created with the command line tool iasobf. If you must use a regular wallet, Oracle recommends that you use the obfuscated password instead of a cleartext password.

11.4.3.1 SSLProxyCache

Specifies whether the proxy cache will be used. The proxy will use the same session as the SSL server uses.

11.4.3.2 SSLProxyCipherSuite

Specifies the proxy server's cipher suite.

11.4.3.3 SSLProxyProtocol

Controls the proxy server's SSL protocol flavors.

11.4.3.4 SSLProxyWallet

Specifies the location of the wallet containing the certificates to use when opening proxy connections.

11.4.3.5 SSLProxyWalletPassword

Specifies the proxy wallet password.