SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Improve install-server-certificate.md

Browse source 
* Add technical hint about ERR_SSL_KEY_USAGE_INCOMPATIBLE.
 * Improve format and spelling.
 * Remove OSCP hint as this is related to client certificates.
This commit is contained in:
Bernhard Reiter 2022-02-14 10:45:02 +01:00
parent d3f99189b5
commit 122cfb4757
No known key found for this signature in database
GPG key ID: 2B7BA3BF9BC3A554
1 changed files with 11 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/install-server-certificate.md
View file

@ -2,7 +2,7 @@
## Get a webserver TLS certificate
There are three ways to get to a TLS certificate for your HTTPS server:
There are three ways to get a TLS certificate for your HTTPS server:
1. Get it from a certificate provider who will run a certificate
authority (CA) and also offers
[extended validation](https://en.wikipedia.org/wiki/Extended_Validation_Certificate) (EV)
@ -35,12 +35,12 @@ Follow the [nginx documentation](https://docs.nginx.com/nginx/admin-guide/securi
to further configure TLS with your private key and the certificates.
We recommend to
* enable checking the validation of the certificate
which can be done by OSCP
* restricting the TLS protocol version and ciphers following a current
* restrict the TLS protocol version and ciphers following a current
recommendation (e.g. [BSI-TR-02102-2](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-2.html)).
### Example configuration
Assuming the relevant server block is in `/etc/nginx/sites-enabled/default`,
change the `listen` configuration and add options so nginx
finds your your private key and the certificate chain.
@ -64,3 +64,9 @@ Replace `{domainName}` with the name for your certificate in the example.
Reload or restart nginx to apply the changes (e.g. `systemctl reload nginx`
on Debian or Ubuntu.)
Technical hints:
* When allowing or requiring `TLSv1.3` webbrowsers like
Chromium (seen with version 98) may have higher requirements
on the server certificates they allow,
otherwise they do not connect with `ERR_SSL_KEY_USAGE_INCOMPATIBLE`.