erwan83 Du Shift DEL tu te méfieras ! | Bonjour
Je viens demander ici en désespoir de cause.
J'ai fait tous les tutos, tous les topics et je plante toujours pour acceder à mon site en https
Je vais essayer de faire un copier coller de mes fichiers pour vous montrer
Je suis sous Windows avec un serveur Wampserver64 version Apache 2.4.41
Toute aide serait extrêmement appréciée.
En local quand j'essaye d'acceder au site via SSL , j'ai ce message :
Ce site ne peut pas fournir de connexion sécurisée
Dans Apache/conf/cert j'ai généré un fichier .RND
Dans Apache/conf/key j'ai un fichier private.key
Dans Apache/conf/ssl j'ai le certificat et son fichier .KEY
Httpd.conf ==>
Code :
- # Listen: Allows you to bind Apache to specific IP addresses and/or
- # ports, instead of the default. See also the <VirtualHost>
- # directive.
- #
- # Change this to Listen on specific IP addresses as shown below to
- # prevent Apache from glomming onto all bound IP addresses.
- #
- #Listen 12.34.56.78:80
- Listen 0.0.0.0:80
- Listen 0.0.0.0:443
- ### celui-ci permet de passer mais ca ne marche que en local
- Listen [:0]:80
- Listen [:0]:443
- LoadModule access_compat_module modules/mod_access_compat.so
- LoadModule actions_module modules/mod_actions.so
- LoadModule alias_module modules/mod_alias.so
- LoadModule allowmethods_module modules/mod_allowmethods.so
- LoadModule asis_module modules/mod_asis.so
- LoadModule auth_basic_module modules/mod_auth_basic.so
- LoadModule auth_digest_module modules/mod_auth_digest.so
- LoadModule authn_core_module modules/mod_authn_core.so
- LoadModule authn_file_module modules/mod_authn_file.so
- LoadModule authz_core_module modules/mod_authz_core.so
- LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
- LoadModule authz_host_module modules/mod_authz_host.so
- LoadModule authz_user_module modules/mod_authz_user.so
- LoadModule autoindex_module modules/mod_autoindex.so
- LoadModule cache_module modules/mod_cache.so
- LoadModule cache_disk_module modules/mod_cache_disk.so
- LoadModule dir_module modules/mod_dir.so
- LoadModule env_module modules/mod_env.so
- LoadModule file_cache_module modules/mod_file_cache.so
- LoadModule include_module modules/mod_include.so
- LoadModule isapi_module modules/mod_isapi.so
- LoadModule log_config_module modules/mod_log_config.so
- LoadModule mime_module modules/mod_mime.so
- #LoadModule mime_magic_module modules/mod_mime_magic.so
- LoadModule negotiation_module modules/mod_negotiation.so
- LoadModule rewrite_module modules/mod_rewrite.so
- #LoadModule session_crypto_module modules/mod_session_crypto.so
- #LoadModule session_dbd_module modules/mod_session_dbd.so
- LoadModule setenvif_module modules/mod_setenvif.so
- ###### ci dessous decoché
- LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
- LoadModule ssl_module modules/mod_ssl.so
- LoadModule userdir_module modules/mod_userdir.so
- LoadModule vhost_alias_module modules/mod_vhost_alias.so
- PHPIniDir "${APACHE_DIR}/bin"
- LoadModule php7_module "${INSTALL_DIR}/bin/php/php7.4.0/php7apache2_4.dll"
- <IfModule unixd_module>
- #
- # If you wish httpd to run as a different user or group, you must run
- # httpd as root initially and it will switch.
- #
- # User/Group: The name (or #number) of the user/group to run httpd as.
- # It is usually good practice to create a dedicated user and group for
- # running httpd, as with most system services.
- #
- User daemon
- Group daemon
- </IfModule>
- # 'Main' server configuration
- #
- # The directives in this section set up the values used by the 'main'
- # server, which responds to any requests that aren't handled by a
- # <VirtualHost> definition. These values also provide defaults for
- # any <VirtualHost> containers you may define later in the file.
- #
- # All of these directives may appear inside <VirtualHost> containers,
- # in which case these default settings will be overridden for the
- # virtual host being defined.
- #
- ServerName localhost:80
- <Files "*.*">
- order allow,deny
- allow from all
- </Files>
- <Directory />
- AllowOverride none
- # Require all denied
- Require all granted
- </Directory>
- HostnameLookups Off
- DocumentRoot "${INSTALL_DIR}/www"
- <Directory "${INSTALL_DIR}/www/">
- Options +Indexes +FollowSymLinks +Multiviews
- AllowOverride all
- # onlineoffline tag - don't remove
- # Require local
- Require all granted
- </Directory>
- <IfModule dir_module>
- DirectoryIndex index.php index.php3 index.html index.htm
- </IfModule>
- #
- # The following lines prevent .htaccess and .htpasswd files from being
- # viewed by Web clients.
- #
- <Files ".ht*">
- Require all denied
- </Files>
- ErrorLog "${INSTALL_DIR}/logs/apache_error.log"
- LogLevel warn
- <IfModule log_config_module>
- LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
- LogFormat "%h %l %u %t \"%r\" %>s %b" common
- <IfModule logio_module>
- # You need to enable mod_logio.c to use %I and %O
- LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
- </IfModule>
- CustomLog "${INSTALL_DIR}/logs/access.log" common
- </IfModule>
- <IfModule alias_module>
- ScriptAlias /cgi-bin/ "${SRVROOT}/cgi-bin/"
- </IfModule>
- <IfModule cgid_module>
- </IfModule>
- <Directory "${SRVROOT}/cgi-bin">
- AllowOverride None
- Options None
- Require all granted
- </Directory>
- <IfModule headers_module>
- RequestHeader unset Proxy early
- </IfModule>
- <IfModule mime_module>
- #
- # TypesConfig points to the file containing the list of mappings from
- # filename extension to MIME-type.
- #
- TypesConfig conf/mime.types
- #
- # AddEncoding allows you to have certain browsers uncompress
- # information on the fly. Note: Not all browsers support this.
- #
- AddEncoding x-compress .Z
- AddEncoding x-gzip .gz .tgz
- #
- # If the AddEncoding directives above are commented-out, then you
- # probably should define those extensions to indicate media types:
- #
- AddType application/x-compress .Z
- AddType application/x-gzip .gz .tgz
- AddType application/x-httpd-php .php
- AddType application/x-httpd-php .php3
- # AddHandler allows you to map certain file extensions to "handlers":
- # actions unrelated to filetype. These can be either built into the server
- # or added with the Action directive (see below)
- #
- # To use CGI scripts outside of ScriptAliased directories:
- # (You will also need to add "ExecCGI" to the "Options" directive.)
- #
- #AddHandler cgi-script .cgi
- # For type maps (negotiated resources):
- #AddHandler type-map var
- #
- # Filters allow you to process content before it is sent to the client.
- #
- # To parse .shtml files for server-side includes (SSI):
- # (You will also need to add "Includes" to the "Options" directive.)
- #
- #AddType text/html .shtml
- #AddOutputFilter INCLUDES .shtml
- </IfModule>
- #
- # The mod_mime_magic module allows the server to use various hints from the
- # contents of the file itself to determine its type. The MIMEMagicFile
- # directive tells the module where the hint definitions are located.
- #
- #MIMEMagicFile conf/magic
- #
- # MaxRanges: Maximum number of Ranges in a request before
- # returning the entire resource, or one of the special
- # values 'default', 'none' or 'unlimited'.
- # Default setting is to accept 200 Ranges.
- #MaxRanges unlimited
- # Defaults: EnableMMAP On, EnableSendfile Off
- #
- #EnableMMAP off
- EnableSendfile off
- # AcceptFilter: On Windows, none uses accept() rather than AcceptEx() and
- # will not recycle sockets between connections. This is useful for network
- # adapters with broken driver support, as well as some virtual network
- # providers such as vpn drivers, or spam, virus or spyware filters.
- AcceptFilter http none
- AcceptFilter https none
- # Server-pool management (MPM specific)
- Include conf/extra/httpd-mpm.conf
- # Multi-language error messages
- #Include conf/extra/httpd-multilang-errordoc.conf
- # Fancy directory listings
- Include conf/extra/httpd-autoindex.conf
- # Language settings
- #Include conf/extra/httpd-languages.conf
- # User home directories
- #Include conf/extra/httpd-userdir.conf
- # Real-time info on requests and configuration
- #Include conf/extra/httpd-info.conf
- # Virtual hosts
- Include conf/extra/httpd-vhosts.conf
- # Local access to the Apache HTTP Server Manual
- #Include conf/extra/httpd-manual.conf
- # Distributed authoring and versioning (WebDAV)
- #Include conf/extra/httpd-dav.conf
- # Various default settings
- #Include conf/extra/httpd-default.conf
- # Configure mod_proxy_html to understand HTML4/XHTML1
- <IfModule proxy_html_module>
- Include conf/extra/proxy-html.conf
- </IfModule>
- # Secure (SSL/TLS) connections
- # j'ai essayé mais ça plante ==>
- #Include conf/extra/httpd-ssl.conf
- #
- # Note: The following must must be present to support
- # starting without SSL on platforms with no /dev/random equivalent
- # but a statically compiled-in mod_ssl.
- #
- <IfModule ssl_module>
- SSLRandomSeed startup builtin
- SSLRandomSeed connect builtin
- </IfModule>
- Include "${INSTALL_DIR}/alias/*"
|
Httpd-ssl.conf ==>
Code :
- #
- # This is the Apache server configuration file providing SSL support.
- # It contains the configuration directives to instruct the server how to
- # serve pages over an https connection. For detailed information about these
- # directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
- #
- # Do NOT simply read the instructions in here without understanding
- # what they do. They're here only as hints or reminders. If you are unsure
- # consult the online docs. You have been warned.
- #
- # Required modules: mod_log_config, mod_setenvif, mod_ssl,
- ###### retiré
- socache_shmcb_module (for default value of SSLSessionCache)
- #
- # Pseudo Random Number Generator (PRNG):
- #SSLRandomSeed startup file:/dev/random 512
- #SSLRandomSeed startup file:/dev/urandom 512
- #SSLRandomSeed connect file:/dev/random 512
- #SSLRandomSeed connect file:/dev/urandom 512
- #
- # When we also provide SSL we have to listen to the
- # standard HTTP port (see above) and to the HTTPS port
- #
- Listen 443
- ##
- ## SSL Global Context
- ##
- ## All SSL configuration in this context applies both to
- ## the main server and all SSL-enabled virtual hosts.
- ##
- SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
- SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
- # SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
- # SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
- # User agents such as web browsers are not configured for the user's
- # own preference of either security or performance, therefore this
- # must be the prerogative of the web server administrator who manages
- # cpu load versus confidentiality, so enforce the server's cipher order.
- SSLHonorCipherOrder on
- # SSL Protocol support:
- SSLProtocol all -SSLv3
- SSLProxyProtocol all -SSLv3
- # Pass Phrase Dialog:
- # Configure the pass phrase gathering process.
- # The filtering dialog program (`builtin' is an internal
- # terminal dialog) has to provide the pass phrase on stdout.
- SSLPassPhraseDialog builtin
- # Inter-Process Session Cache:
- # Configure the SSL Session Cache: First the mechanism
- # to use and second the expiring timeout (in seconds).
- SSLSessionCache "shmcb:***************/apache2.4.41/conf/ssl/logs/ssl_scache(512000)"
- SSLSessionCacheTimeout 300
- # Enable stapling for all SSL-enabled servers:
- #SSLUseStapling On
- # Define a relatively small cache for OCSP Stapling using
- # the same mechanism that is used for the SSL session cache
- # above. If stapling is used with more than a few certificates,
- # the size may need to be increased. (AH01929 will be logged.)
- #SSLStaplingCache "shmcb:${SRVROOT}/logs/ssl_stapling(32768)"
- # Seconds before valid OCSP responses are expired from the cache
- #SSLStaplingStandardCacheTimeout 3600
- # Seconds before invalid OCSP responses are expired from the cache
- #SSLStaplingErrorCacheTimeout 600
- ##
- ## SSL Virtual Host Context
- ##
- <VirtualHost _default_:443>
- # General setup for the virtual host
- DocumentRoot "********************/
- ServerName localhost:443
- ServerAdmin admin@example.com
- ErrorLog "*************/apache2.4.41/conf/ssl/logs/ssl_error.log"
- TransferLog "********************/apache2.4.41/conf/ssl/logs/ssl_access.log"
- # SSL Engine Switch:
- # Enable/Disable SSL for this virtual host.
- SSLEngine on
- # Server Certificate:
- # Point SSLCertificateFile at a PEM encoded certificate. If
- # the certificate is encrypted, then you will be prompted for a
- # pass phrase. Note that a kill -HUP will prompt again. Keep
- # in mind that if you have both an RSA and a DSA certificate you
- # can configure both in parallel (to also allow the use of DSA
- # ciphers, etc.)
- # Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
- # require an ECC certificate which can also be configured in
- # parallel.
- SSLCertificateFile "********************/apache2.4.41/conf/ssl/localhost.crt"
- #SSLCertificateFile "${SRVROOT}/conf/server-dsa.crt"
- #SSLCertificateFile "${SRVROOT}/conf/server-ecc.crt"
- # Server Private Key:
- # If the key is not combined with the certificate, use this
- # directive to point at the key file. Keep in mind that if
- # you've both a RSA and a DSA private key you can configure
- # both in parallel (to also allow the use of DSA ciphers, etc.)
- # ECC keys, when in use, can also be configured in parallel
- SSLCertificateKeyFile "***************/apache2.4.41/conf/ssl/localhost.key"
- #SSLCertificateKeyFile "${SRVROOT}/conf/server-dsa.key"
- #SSLCertificateKeyFile "${SRVROOT}/conf/server-ecc.key"
- # Server Certificate Chain:
- # Point SSLCertificateChainFile at a file containing the
- # concatenation of PEM encoded CA certificates which form the
- # certificate chain for the server certificate. Alternatively
- # the referenced file can be the same as SSLCertificateFile
- # when the CA certificates are directly appended to the server
- # certificate for convenience.
- #SSLCertificateChainFile "${SRVROOT}/conf/server-ca.crt"
- # Certificate Authority (CA):
- # Set the CA certificate verification path where to find CA
- # certificates for client authentication or alternatively one
- # huge file containing all of them (file must be PEM encoded)
- # Note: Inside SSLCACertificatePath you need hash symlinks
- # to point to the certificate files. Use the provided
- # Makefile to update the hash symlinks after changes.
- #SSLCACertificatePath "${SRVROOT}/conf/ssl.crt"
- #SSLCACertificateFile "${SRVROOT}/conf/ssl.crt/ca-bundle.crt"
- # Certificate Revocation Lists (CRL):
- # Set the CA revocation path where to find CA CRLs for client
- # authentication or alternatively one huge file containing all
- # of them (file must be PEM encoded).
- # The CRL checking mode needs to be configured explicitly
- # through SSLCARevocationCheck (defaults to "none" otherwise).
- # Note: Inside SSLCARevocationPath you need hash symlinks
- # to point to the certificate files. Use the provided
- # Makefile to update the hash symlinks after changes.
- #SSLCARevocationPath "${SRVROOT}/conf/ssl.crl"
- #SSLCARevocationFile "${SRVROOT}/conf/ssl.crl/ca-bundle.crl"
- #SSLCARevocationCheck chain
- # Client Authentication (Type):
- # Client certificate verification type and depth. Types are
- # none, optional, require and optional_no_ca. Depth is a
- # number which specifies how deeply to verify the certificate
- # issuer chain before deciding the certificate is not valid.
- #SSLVerifyClient require
- #SSLVerifyDepth 10
- # TLS-SRP mutual authentication:
- # Enable TLS-SRP and set the path to the OpenSSL SRP verifier
- # file (containing login information for SRP user accounts).
- # Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
- # detailed instructions on creating this file. Example:
- # "openssl srp -srpvfile ${SRVROOT}/conf/passwd.srpv -add username"
- #SSLSRPVerifierFile "${SRVROOT}/conf/passwd.srpv"
- # Access Control:
- # With SSLRequire you can do per-directory access control based
- # on arbitrary complex boolean expressions containing server
- # variable checks and other lookup directives. The syntax is a
- # mixture between C and Perl. See the mod_ssl documentation
- # for more details.
- #<Location />
- #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
- # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
- # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
- # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
- # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
- # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
- #</Location>
- # SSL Engine Options:
- # Set various options for the SSL engine.
- #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
- <FilesMatch "\.(cgi|shtml|phtml|php)$">
- SSLOptions +StdEnvVars
- </FilesMatch>
- <Directory "${SRVROOT}/cgi-bin">
- SSLOptions +StdEnvVars
- Options Indexes FollowSymLinks MultiViews
- AllowOverride All
- Order allow,deny
- allow from all
- </Directory>
- # SSL Protocol Adjustments:
- # The safe and default but still SSL/TLS standard compliant shutdown
- # approach is that mod_ssl sends the close notify alert but doesn't wait for
- # the close notify alert from client. When you need a different shutdown
- # approach you can use one of the following variables:
- # "force-response-1.0" for this.
- BrowserMatch "MSIE [2-5]" \
- nokeepalive ssl-unclean-shutdown \
- downgrade-1.0 force-response-1.0
- # Per-Server Logging:
- # The home of a custom SSL log file. Use this when you want a
- # compact non-error SSL logfile on a virtual host basis.
- CustomLog "***************/apache2.4.41/conf/ssl/logs/ssl_request.log" \
- "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
- </VirtualHost>
|
|