# Recommended Apache config **URL:** \ **Category:** Server\ **Created:** [April 1, 2018, 9:46am UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294 "2018-04-01T09:46:04Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![aavmurphy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aavmurphy/32/22128_2.png) [@aavmurphy](https://community.letsencrypt.org/u/aavmurphy)\ **Post date:** [April 1, 2018, 9:46am UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/1 "2018-04-01T09:46:04Z")
Is there a standard/recommended Apache config for using SSL. My current one is based on various web sources, but things have probably moved on since I last looked in to it. Thanks Andrew ``` #SSL SSLCertificateFile /etc/letsencrypt/live/[dir]/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/[dir]/privkey.pem SSLCertificateChainFile /etc/letsencrypt/live/[dir]/chain.pem #SSL stapling SSLStaplingCache shmcb:/tmp/stapling_cache(128000) # Intermediate configuration, tweak to your needs SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA SSLHonorCipherOrder on SSLCompression off SSLOptions +StrictRequire ``` ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [April 1, 2018, 10:02am UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/2 "2018-04-01T10:02:53Z")
> [@aavmurphy](#): > > Is there a standard/recommended Apache config for using SSL. Yes, there is. [https://mozilla.github.io/server-side-tls/ssl-config-generator/](https://mozilla.github.io/server-side-tls/ssl-config-generator/) ---
**Author:** ![aavmurphy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aavmurphy/32/22128_2.png) [@aavmurphy](https://community.letsencrypt.org/u/aavmurphy)\ **Post date:** [April 1, 2018, 7:11pm UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/3 "2018-04-01T19:11:19Z")
[I was wrong - see \_az’s reply below] Thanks \_az. It seemed such an obvious question that there had to be an ‘official’ answer. I tested the “mozilla” “modern” config with the ssllabs online test : [https://www.ssllabs.com/ssltest/index.html](https://www.ssllabs.com/ssltest/index.html) =\> the mozilla config leaves out the chain file =\> the ssllabs test wants it (without it, got a B, with it, an A+) Might be worth recommending the “mozilla config” it in the Letsencrypt documentation. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [April 1, 2018, 10:33pm UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/4 "2018-04-01T22:33:20Z")
If you pass fullchain.pem to `SSLCertificateFile` in Apache 2.4.8 or newer, it will automatically deal with chaining the intermediate for you. If you enter your Apache version into the _Server Version_ field on the config generator, it will automatically adjust the configuration for you, to reflect the above. Same thing with OpenSSL version and the ciphersuite selection. ---
**Author:** ![aavmurphy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aavmurphy/32/22128_2.png) [@aavmurphy](https://community.letsencrypt.org/u/aavmurphy)\ **Post date:** [April 2, 2018, 7:37am UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/5 "2018-04-02T07:37:30Z")
Thanks again \_az This gets A+ This is an excerpt from the recommended config. Do I need the SSLCACertificateFile? ``` SSLCertificateFile /etc/letsencrypt/live/[dir]/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/[dir]/privkey.pem # Uncomment the following directive when using client certificate authentication # SSLCACertificateFile /path/to/ca_certs_for_client_authentication ``` ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [April 2, 2018, 9:57am UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/6 "2018-04-02T09:57:41Z")
No you don’t, it’s for client certificates which is used for mutual authentication (if you needed it, you’d know it). ---
**Author:** ![aavmurphy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aavmurphy/32/22128_2.png) [@aavmurphy](https://community.letsencrypt.org/u/aavmurphy)\ **Post date:** [April 3, 2018, 10:21pm UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/7 "2018-04-03T22:21:33Z")
Thanks again! \_az’s solution is: Use the config from [https://mozilla.github.io/server-side-tls/ssl-config-generator/](https://mozilla.github.io/server-side-tls/ssl-config-generator/) with: ``` SSLCertificateFile /etc/letsencrypt/live/[dir]/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/[dir]/privkey.pem ``` And don’t worry about the `SSLCACertificateFile` directive ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 3, 2018, 10:21pm UTC](https://community.letsencrypt.org/t/recommended-apache-config/58294/8 "2018-05-03T22:21:52Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.