Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to SSL. I set it up on my CentOS 5 system running Apache 2.2.3-65. It appears to be working -- a can browse my site and the https protocol is displayed in the address bar.

Here's my SSL vhost config. Does it look OK? Did I make any major errors?

The intention is for all traffic for this particular site to be encrypted, so there's no vhost for port 80, just this one.

<VirtualHost *:443>
    DocumentRoot "/opt/deployed_rails_apps/my_app/current/public"

    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/
    SSLCertificateKeyFile /etc/pki/tls/certs/
    SSLCACertificateFile /etc/pki/tls/certs/

    ErrorLog "logs/"
    CustomLog "logs/" common
    CustomLog "logs/" deflate
    <Directory "/opt/deployed_rails_apps/rock_pebble/current/public">
        Options -MultiViews FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
share|improve this question
Qualsys SSL Labs check page: Lets you know if there's any concerns by an external check. – Fiasco Labs Jul 13 '12 at 3:25
up vote 4 down vote accepted

That will work, certainly. But here are a few more options that you should include for better security:

SSLHonorCipherOrder On
SSLProtocol all -SSLv2
Header add Strict-Transport-Security "max-age=15768000"

You should also check your server security against SSL Pulse and see their SSL Best Practices Guide. There's also an SSL Rating Guide which explains why these options are a good idea.

share|improve this answer

Looks fine, but remove the ServerAlias directive unless your cert will work on both "" and "".

share|improve this answer
Thanks -- the cert (Commodo "PositiveSSL") is advertised as being able to work for both. – Agvorth Jul 13 '12 at 3:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.