Appendix B SSL Configuration Directives for Apache Web Servers 147
Thepreference of ciphers can be configured using the special characters listed and
described in TABLEB-4.
The default value of cipher-spec is
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
The default configures all ciphers except anonymous (unauthenticated) Diffie-
Hellman, giving preference to ARCFOUR and RSA, and then higher grades of
encryption over the lower grades.
5. SSLCertificateFilefile
Context: Global, virtual host
This directive specifies the location of the PEM-encoded X.509 certificate filefor
this server.
6. SSLCertificateKeyFile file
Context: Global, virtual host
This directive specifies the location of the PEM-encoded private key file for this
server,corresponding to the certificate configured with the
SSLCertificateFile directive.
7. SSLCertificateChainFile file
Context: Global, virtual host
This directive specifies the location of a filecontaining the PEM-encoded
certificates making up the certification path of the server.You can use the
directive to assist clients in verifying the server's certificate when the server's
certificate is not directly signed by an authority that the client recognizes.
ADH All ciphers using anonymous Diffie-Hellmankey exchange
DSS All ciphers using DSS authentication
NULL All ciphers using no encryption
TABLEB-4 Special Characters to Configure Cipher Preference
Character Description
<none> Add cipher to list
! Remove a cipher fromthe listentirely—it cannot be added again
+ Addcipher to list, and pull to current location (possibly demoting it)
- Remove cipher from list (can be added later in list)
TABLEB-3 SSL Aliases (Continued)
Alias Description