apache_ssl_16.sh

#! /bin/bash/

#Usage: source apache_ssh_certificate.sh #Creates self-signed SSL Certificate based on Digital Oceans guide #(https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-16-04#prerequisites) #Assumes a version of Ubuntu 16 and sudo access

#Create the SSL Certificate sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt

Create a strong Fiddie-Helman group

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

#Configure Apache to Use SSL echo '# from https://cipherli.st/ # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html

  SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
  SSLProtocol All -SSLv2 -SSLv3
  SSLHonorCipherOrder On
  # Disable preloading HSTS for now.  You can use the commented out header line that includes
  # the "preload" directive if you understand the implications.
  #Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
  Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
  Header always set X-Frame-Options DENY
  Header always set X-Content-Type-Options nosniff
  # Requires Apache >= 2.4
  SSLCompression off 
  SSLSessionTickets Off
  SSLUseStapling on 
  SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

  SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem" ' | sudo tee /etc/apache2/conf-available/ssl-params.conf > /dev/null

#Modify the default apache ssl virtual host file...make a backup first sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf.bak

read -p "What is your email address? : " email read -p "What is your server domain or ip address? : " server_domain

echo ' ServerAdmin "$email" ServerName "$server_domain"

            DocumentRoot /var/www/html

            ErrorLog ${APACHE_LOG_DIR}/error.log
            CustomLog ${APACHE_LOG_DIR}/access.log combined

            SSLEngine on

            SSLCertificateFile      /etc/ssl/certs/apache-selfsigned.crt
            SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key

            <FilesMatch "\.(cgi|shtml|phtml|php)$">
                            SSLOptions +StdEnvVars
            </FilesMatch>
            <Directory /usr/lib/cgi-bin>
                            SSLOptions +StdEnvVars
            </Directory>

            BrowserMatch "MSIE [2-6]" \
                           nokeepalive ssl-unclean-shutdown \
                           downgrade-1.0 force-response-1.0

    </VirtualHost>
</IfModule> ' | sudo tee /etc/apache2/sites-available/default-ssl.conf > /dev/null

#Modify the unencrypted virutaul host file to redirect to https

echo "<VirtualHost *:80> Redirect "/" https://server_domain

    # The ServerName directive sets the request scheme, hostname and port that
    # the server uses to identify itself. This is used when creating
    # redirection URLs. In the context of virtual hosts, the ServerName
    # specifies what hostname must appear in the requests Host: header to
    # match this virtual host. For the default virtual host (this file) this
    # value is not decisive as it is used as a last resort host regardless.
    # However, you must set it for any further virtual host explicitly.
    #ServerName www.example.com

	ServerAdmin webmaster@localhost
	DocumentRoot /var/www/html

    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn

	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined

    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with \"a2disconf\".
    #Include conf-available/serve-cgi-bin.conf

vim: syntax=apache ts=4 sw=4 sts=4 sr noet" | sudo tee /etc/apache2/sites-available/000-default.conf > /dev/null

#Adjust firewall sudo ufw allow 'Apache Full' sudo ufw allow 'OpenSSH' sudo ufw delete allow 'Apache' sudo ufw enable

#Enable the Changes in Apache sudo a2enmod ssl sudo a2enmod headers sudo a2ensite default-ssl sudo a2enconf ssl-params sudo apache2ctl configtest sudo systemctl restart apache2