In the previous chapter we have described basic proxying techniques using plain HTTP listener as an example. Now we will discuss how to use HTTPS both for listeners and backends.
To accept HTTPS requests you need to declare ListenerHTTPS
listener. It is similar to plain ListenerHTTP described above,
except that it requires a certificate to be declared. For
example:
ListenHTTPS
Address 0.0.0.0
Port 443
Cert "/etc/ssl/priv/example.pem"
Disable TLSv1
Ciphers "HIGH:@STRENGTH:!RSA"
End
The Cert statement supplies the name of the certificate file
in PEM format. The file must contain the certificate, intermediate
certificates (if necessary), and certificate private key, in that
order.
The Cert argument can also specify a directory, in which case
pound will scan that directory, trying to read the certificate
from each regular file encountered. It will report an error if unable
to load the file, so this directory should contain only certificate
files. The order in which certificate files are read is not
specified.
Multiple Cert statements are allowed. When trying to find the
matching certificate, pound will stop at the first one whose
CN matches the requested host name. Thus, the ordering of
Cert statements is important. Normally they should be placed
in most-specific to least-specific order, with wildcard certificates
appearing after host-specific ones.
Cert directives must precede all other SSL-specific directives.
Another important directive is Disable. It disables the use
of the specified TLS protocol as well as all protocols older than it.
Usually it is used to disable obsolete protocols. For example,
the Disable statement in the example above disables ‘TLSv1’,
‘SSLv3’, and ‘SSLv2’.
To further tune the strength of your encryption use the Ciphers
directive. Its argument is a colon-delimited list of OpenSSL ciphers,
as described in See (ciphers(1))ciphers. The cipher selection
shown in the example above provides for excellent encryption strength.