RHEL 6 Deployment - 11.3.2. Common ssl.conf Directives

Red Hat Enterprise Linux 9 Essentials Book now available.

Purchase a copy of Red Hat Enterprise Linux 9 (RHEL 9) Essentials

Red Hat Enterprise Linux 9 Essentials Print and eBook (PDF) editions contain 34 chapters and 298 pages

11.3.2. Common `ssl.conf` Directives

The Secure Sockets Layer (SSL) directives allow you to customize the behavior of the Apache HTTP Secure Server, and in most cases, they are configured appropriately during the installation. Be careful when changing these settings, as incorrect configuration can lead to security vulnerabilities.

The following directive is commonly used in /etc/httpd/conf.d/ssl.conf:

SetEnvIf

The SetEnvIf directive allows you to set environment variables based on the headers of incoming connections. It takes the following form:

SetEnvIf option pattern [!]variable[=value]…

The option can be either a HTTP header field, a previously defined environment variable name, or a valid keyword as described in Table 11.21, “Available SetEnvIf options”. The pattern is a regular expression. The variable is an environment variable that is set when the option matches the pattern. If the optional exclamation mark (that is, !) is present, the variable is removed instead of being set.

Table 11.21. Available `SetEnvIf` options

Option	Description
`Remote_Host`	Refers to the client's hostname.
`Remote_Addr`	Refers to the client's IP address.
`Server_Addr`	Refers to the server's IP address.
`Request_Method`	Refers to the request method (for example, `GET`).
`Request_Protocol`	Refers to the protocol name and version (for example, `HTTP/1.1`).
`Request_URI`	Refers to the requested resource.

The SetEnvIf directive is used to disable HTTP keepalives, and to allow SSL to close the connection without a closing notification from the client browser. This is necessary for certain web browsers that do not reliably shut down the SSL connection.

Example 11.70. Using the `SetEnvIf` directive

SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

Note that for the /etc/httpd/conf.d/ssl.conf file to be present, the mod_ssl needs to be installed. Refer to Section 11.6, “Setting Up an SSL Server” for more information on how to install and configure an SSL server.

11.3.2. Common ssl.conf Directives

Table 11.21. Available SetEnvIf options

Example 11.70. Using the SetEnvIf directive

11.3.2. Common `ssl.conf` Directives

Table 11.21. Available `SetEnvIf` options

Example 11.70. Using the `SetEnvIf` directive