<commit_before><!doctype html>
<html>

<head>
    <meta charset="utf-8" />
    <title>Generate Mozilla Security Recommended Web Server Configuration Files</title>
    <link rel="stylesheet" type="text/css" media="all" href="../css/screen.css" />
    <link href="//mozorg.cdn.mozilla.net/media/css/tabzilla-min.css" rel="stylesheet" />
    <style>
        div#server-config-text pre {
            background-color: #F7F7F7;
            border-radius: 3px;
            padding: 2em;
        }
        label, p {
            font-family: 'Open Sans', "Lucida Sans", "Lucida Grande", "Lucida Sans Unicode", Verdana, sans-serif;
            font-weight: normal;
            text-shadow: 0px 1px 0px rgba(255, 255, 255, 0.75);
        }
        .message {
            font-size: 150%;
        }
        pre {
            overflow-x: auto;
        }

    </style>

    <script src="//ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
    <script src="//cdnjs.cloudflare.com/ajax/libs/handlebars.js/2.0.0/handlebars.min.js"></script>
    <script src="//mozorg.cdn.mozilla.net/en-US/tabzilla/tabzilla.js"></script>
    <link rel="stylesheet" href="//ajax.googleapis.com/ajax/libs/jqueryui/1.11.3/themes/smoothness/jquery-ui.css">
    <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.11.3/jquery-ui.min.js"></script>
    <script>
        // https://gist.github.com/cowboy/566233
        var isSemVer=(function(){var a=/^(<|>|[=!<>]=)?\s*(\d+(?:\.\d+){0,2})([a-z][a-z0-9\-]*)?$/i;function b(e,c){var d=(e+"").match(a);return d?(c?(d[1]||"=="):"")+'"'+(d[2]+".0.0").match(/\d+(?:\.\d+){0,2}/)[0].replace(/(?:^|\.)(\d+)/g,function(g,f){return Array(9-f.length).join(0)+f;})+(d[3]||"~")+'"':(c?"==0":1);}return function(e){e=b(e);for(var c,d=1;c=arguments[d++];){if(!(new Function("return "+e+b(c,1)))()){return false;}}return true;};})();
        // isSemVer says "1.0.1 > 1.0.1e" and isOpenSSLSemVer says "1.0.1 < 1.0.1e". isOpenSSLSemVer is needed to accommodate OpenSSL's version grammar
        var isOpenSSLSemVer=(function(){var a=/^(<|>|[=!<>]=)?\s*(\d+(?:\.\d+){0,2})([a-z][a-z0-9\-]*)?$/i;function b(e,c){var d=(e+"").match(a);return d?(c?(d[1]||"=="):"")+'"'+(d[2]+".0.0").match(/\d+(?:\.\d+){0,2}/)[0].replace(/(?:^|\.)(\d+)/g,function(g,f){return Array(9-f.length).join(0)+f;})+(d[3]||"")+'"':(c?"==0":1);}return function(e){e=b(e);for(var c,d=1;c=arguments[d++];){if(!(new Function("return "+e+b(c,1)))()){return false;}}return true;};})();
    </script>
    <script>
        if (window.location.protocol != "https:")
            window.location.href = "https:" + window.location.href.substring(window.location.protocol.length);
    </script>

    <script id="nginx-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<pre>
server {
{{listen}}

    # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
    ssl_certificate /path/to/signed_cert_plus_intermediates;
    ssl_certificate_key /path/to/private_key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
{{sslSessionTickets}}
{{dhparam}}

    # {{securityProfile}} configuration. tweak to your needs.
    ssl_protocols {{sslProtocols}};
    ssl_ciphers '{{cipherSuites}}';
    ssl_prefer_server_ciphers on;
{{hsts}}
{{ocspstapling}}

    resolver &lt;IP DNS resolver&gt;;
 
    ....
}
</pre>
    </script>

    <script id="apache-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<pre>
&lt;VirtualHost *:443&gt;
    ...
    SSLEngine on
{{certFile}}
    SSLCertificateKeyFile   /path/to/private/key
    SSLCACertificateFile    /path/to/all_ca_certs

    # {{securityProfile}} configuration, tweak to your needs
    SSLProtocol             {{sslProtocols}}
    SSLCipherSuite          {{cipherSuites}}
    SSLHonorCipherOrder     on
{{compression}}
{{sslSessionTickets}}
{{ocspStapling}}
{{hsts}}
    ...
&lt;/VirtualHost&gt;
{{ocspStaplingCache}}
</pre>
    </script>

    <script id="haproxy-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<span class="message">{{message}}</span>
<pre style="visibility: {{visibility}};">
global
    # set default parameters to the {{securityProfile}} configuration
    tune.ssl.default-dh-param {{maxDHKeySize}}
    ssl-default-bind-ciphers {{cipherSuites}}
    ssl-default-bind-options no-tls-tickets

frontend ft_test
    mode    http
    bind    0.0.0.0:443 {{sslProtocols}} crt /path/to/&lt;cert+privkey+intermediate+dhparam&gt;
{{hsts}}
</pre>
    </script>

    <script id="elb-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<span class="message">{{message}}</span>
<p>This <a href="https://aws.amazon.com/cloudformation/">Amazon Web Services CloudFormation</a> template <commit_msg>Move Apache server config outside VirtualHost<commit_after><!doctype html>
<html>

<head>
    <meta charset="utf-8" />
    <title>Generate Mozilla Security Recommended Web Server Configuration Files</title>
    <link rel="stylesheet" type="text/css" media="all" href="../css/screen.css" />
    <link href="//mozorg.cdn.mozilla.net/media/css/tabzilla-min.css" rel="stylesheet" />
    <style>
        div#server-config-text pre {
            background-color: #F7F7F7;
            border-radius: 3px;
            padding: 2em;
        }
        label, p {
            font-family: 'Open Sans', "Lucida Sans", "Lucida Grande", "Lucida Sans Unicode", Verdana, sans-serif;
            font-weight: normal;
            text-shadow: 0px 1px 0px rgba(255, 255, 255, 0.75);
        }
        .message {
            font-size: 150%;
        }
        pre {
            overflow-x: auto;
        }

    </style>

    <script src="//ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
    <script src="//cdnjs.cloudflare.com/ajax/libs/handlebars.js/2.0.0/handlebars.min.js"></script>
    <script src="//mozorg.cdn.mozilla.net/en-US/tabzilla/tabzilla.js"></script>
    <link rel="stylesheet" href="//ajax.googleapis.com/ajax/libs/jqueryui/1.11.3/themes/smoothness/jquery-ui.css">
    <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.11.3/jquery-ui.min.js"></script>
    <script>
        // https://gist.github.com/cowboy/566233
        var isSemVer=(function(){var a=/^(<|>|[=!<>]=)?\s*(\d+(?:\.\d+){0,2})([a-z][a-z0-9\-]*)?$/i;function b(e,c){var d=(e+"").match(a);return d?(c?(d[1]||"=="):"")+'"'+(d[2]+".0.0").match(/\d+(?:\.\d+){0,2}/)[0].replace(/(?:^|\.)(\d+)/g,function(g,f){return Array(9-f.length).join(0)+f;})+(d[3]||"~")+'"':(c?"==0":1);}return function(e){e=b(e);for(var c,d=1;c=arguments[d++];){if(!(new Function("return "+e+b(c,1)))()){return false;}}return true;};})();
        // isSemVer says "1.0.1 > 1.0.1e" and isOpenSSLSemVer says "1.0.1 < 1.0.1e". isOpenSSLSemVer is needed to accommodate OpenSSL's version grammar
        var isOpenSSLSemVer=(function(){var a=/^(<|>|[=!<>]=)?\s*(\d+(?:\.\d+){0,2})([a-z][a-z0-9\-]*)?$/i;function b(e,c){var d=(e+"").match(a);return d?(c?(d[1]||"=="):"")+'"'+(d[2]+".0.0").match(/\d+(?:\.\d+){0,2}/)[0].replace(/(?:^|\.)(\d+)/g,function(g,f){return Array(9-f.length).join(0)+f;})+(d[3]||"")+'"':(c?"==0":1);}return function(e){e=b(e);for(var c,d=1;c=arguments[d++];){if(!(new Function("return "+e+b(c,1)))()){return false;}}return true;};})();
    </script>
    <script>
        if (window.location.protocol != "https:")
            window.location.href = "https:" + window.location.href.substring(window.location.protocol.length);
    </script>

    <script id="nginx-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<pre>
server {
{{listen}}

    # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
    ssl_certificate /path/to/signed_cert_plus_intermediates;
    ssl_certificate_key /path/to/private_key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
{{sslSessionTickets}}
{{dhparam}}

    # {{securityProfile}} configuration. tweak to your needs.
    ssl_protocols {{sslProtocols}};
    ssl_ciphers '{{cipherSuites}}';
    ssl_prefer_server_ciphers on;
{{hsts}}
{{ocspstapling}}

    resolver &lt;IP DNS resolver&gt;;
 
    ....
}
</pre>
    </script>

    <script id="apache-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<pre>
&lt;VirtualHost *:443&gt;
    ...
    SSLEngine on
{{certFile}}
    SSLCertificateKeyFile   /path/to/private/key
    SSLCACertificateFile    /path/to/all_ca_certs

{{hsts}}
    ...
&lt;/VirtualHost&gt;

# {{securityProfile}} configuration, tweak to your needs
SSLProtocol             {{sslProtocols}}
SSLCipherSuite          {{cipherSuites}}
SSLHonorCipherOrder     on
{{compression}}
{{sslSessionTickets}}
{{ocspStapling}}
{{ocspStaplingCache}}
</pre>
    </script>

    <script id="haproxy-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<span class="message">{{message}}</span>
<pre style="visibility: {{visibility}};">
global
    # set default parameters to the {{securityProfile}} configuration
    tune.ssl.default-dh-param {{maxDHKeySize}}
    ssl-default-bind-ciphers {{cipherSuites}}
    ssl-default-bind-options no-tls-tickets

frontend ft_test
    mode    http
    bind    0.0.0.0:443 {{sslProtocols}} crt /path/to/&lt;cert+privkey+intermediate+dhparam&gt;
{{hsts}}
</pre>
    </script>

    <script id="elb-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<span class="message">{{message}}</span>
<p>This <a href="https://aws.amazon.com/cloudformation/">Amazon Web Services CloudFormation</a> template 
{'fraction_non_alphanumeric': 0.22738681788602771, 'fraction_numerical': 0.021009575160360696, 'mean_word_length': 3.987482614742698, 'pattern_counts': {'":': 4, '<': 147, '<?xml version=': 0, '>': 147, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2740111', 'n_tokens_mistral': 4107, 'n_tokens_neox': 3881, 'n_words': 609}