<p>Kualitas instalasi SSL pada website kita bisa di cek melalui tools website bernama Qualys SSL. Apabila di cek masih mendapat nilai C ke bawah, maka dipastikan website kita masih terdapat celah bug pada SSL yang kita konfigurasi, biasanya ini terkait dengan chipher yang digunakan oleh SSL tersebut.</p>
<p>Kali saya mau sharing mengenai tips mendapatkan nilai A bahkan A+ untuk SSL ketika di test melalui Qualys SSL serta untuk menutup bug-bug yang ada pada SSL tersebut serta meningkatkan keamanan website.</p>
<p>Pastikan website kita sudah di set menggunakan https dan terinstall SSL, kalau belum, berikut langkah-langkahnya</p>
<h3><span style="color: #000000;">Set HTTPS pada website</span></h3>
<h4><span style="color: #000000;">Siapkan file SSL Certificate</span></h4>
<p>Bila belum ada file SSL nya, bisa order dahulu di Excellent, kami provide berbagai type SSL , dari type Single Domain, Multi Domain hingga Wildcard Domain ->;>; <a href="https://www.excellent.co.id/ssl/" target="_blank" rel="noopener noreferrer">https://www.excellent.co.id/ssl/</a></p>
<h4><span style="color: #000000;">Konfigurasi VirtualHost</span></h4>
<p>Untuk lokasi file virtualhost biasanya berada di directory <strong>/etc/apache2/sites-available/</strong> pada Ubuntu, dan <strong>/etc/httpd/conf.d/</strong> pada CentOS</p>
<p>Berikut ini contoh isian pada virtualhost dimana saya set auto redirect dari http ke https ketika diakses via web browser</p>
<pre><code><;VirtualHost *:80>; 
<span style="color: #ff0000;">DocumentRoot "/var/www/nextcloud"</span> 
ServerName nextcloud.rizkypratama.id 
ServerAdmin root@localhost 
ErrorLog ${APACHE_LOG_DIR}/nextcloud_error.log 
CustomLog ${APACHE_LOG_DIR}/nextcloud_access.log combined 
<span style="color: #ff0000;"><;Directory /var/www/nextcloud/>;</span> 
Options +FollowSymlinks 
AllowOverride All 
<;IfModule mod_dav.c>; 
Dav off 
<;/IfModule>; 
<span style="color: #ff0000;">SetEnv HOME /var/www/nextcloud 
SetEnv HTTP_HOME /var/www/nextcloud</span> 
Satisfy Any 
<;/Directory>; 
<span style="color: #ff0000;">RewriteEngine On 
RewriteCond %{HTTPS} off 
RewriteRule (.*) https://%{HTTP_HOST}:443%{REQUEST_URI}</span> 
<;/VirtualHost>; 
 
<;IfModule mod_ssl.c>; 
<;VirtualHost _default_:443>; 
ServerAdmin root@localhost 
ServerName nextcloud.rizkypratama.id 
<span style="color: #ff0000;">DocumentRoot "/var/www/nextcloud"</span> 
 
ErrorLog ${APACHE_LOG_DIR}/nextcloud_error.log 
CustomLog ${APACHE_LOG_DIR}/nextcloud_access.log combined 
 
<span style="color: #ff0000;">SSLEngine on 
SSLProtocol all -SSLv2 -SSLv3 
</span> 
<span style="color: #ff0000;">SSLCertificateFile /srv/ssl/commercial.crt 
SSLCertificateKeyFile /srv/ssl/commercial.key 
SSLCertificateChainFile /srv/ssl/commercial_ca.crt 
SSLCACertificateFile /srv/ssl/commercial_ca.crt</span> 
 
<;FilesMatch "\.(cgi|shtml|phtml|php)$">; 
SSLOptions +StdEnvVars 
<;/FilesMatch>; 
<;Directory /usr/lib/cgi-bin>; 
SSLOptions +StdEnvVars 
<;/Directory>; 
<;/VirtualHost>; 
<;/IfModule>;</code></pre>
<p>Bagian yang saya beri warna merah silakan disesuaikan saja, lalu save dan enable kan virtualhost nya</p>
<p>Kemudian di cek pada Qualys SSL, mestinya untuk settingan seperti itu maksimal hanya mendapat nilai C ke bawah.</p>
<p>Berikut ini beberapa konfigurasi yang mesti ditambahkan agar bisa mendapat nilai A pada Qualys SSL</p>
<h4>Disable TLSv1.0 dan TLSv1.1</h4>
<p>TLSv1.0 dan TLSv1.1 bisa dikatakan TLS versi lama yang saat ini kemungkinan memiliki celah keamanan sehingga disarankan untuk didisable serta hanya mengaktifkan TLSv1.2 saja</p>
<p>Diantara tag <span class="s1"><;VirtualHost _default_:443>;<br />
</span><span class="s1">&#8230;..<br />
</span><span class="s1"><;/VirtualHost>;</span></p>
<p>dan bagian SSLProtocol, silakan ubah menjadi seperti berikut</p>
<pre>SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1</pre>
<h4><span style="color: #000000;">Aktifkan ChipherOrder</span></h4>
<p>Tambahkan script berikut <span class="s1"> dibawah tulisan <code><span style="color: #ff0000;">SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1</span></code></span></p>
<pre>SSLHonorCipherOrder On 
SSLCipherSuite "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS"</pre>
<h4><span style="color: #000000;">Aktifkan HSTS</span></h4>
<p>Tambahkan script berikut diantara tag <span class="s1"><;VirtualHost _default_:443>;&#8230;..</span><span class="s1"><;/VirtualHost>; juga</span></p>
<pre><code><;IfModule mod_headers.c>; 
	Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" 
<;/IfModule>; 
</code></pre>
<p>Enable Beberapa Module</p>
<p>Selanjutnya aktifkan beberapa module berikut</p>
<pre># a2enmod rewrite env headers mime dir ssl setenvif</pre>
<p>Selanjutnya silakan restart service apache2 nya</p>
<pre># <span style="color: #ff0000;">service apache2 restart</span></pre>
<p>Selanjutnya silakan di test kembali website anda pada Qualys SSL Labs</p>
<p><a href="https://www.ssllabs.com/ssltest/index.html" target="_blank" rel="noopener noreferrer">https://www.ssllabs.com/ssltest/index.html</a></p>
<p>Berikut hasilnya, mestinya akan mendapat nilai A+ dengan konfigurasi seperti diatas</p>
<p><img data-attachment-id="518" data-permalink="https://rizkypratama.id/blog/2018/06/13/tips-mendapatkan-nilai-a-pada-hasil-qualys-ssl-labs-apache/screen-shot-2018-06-13-at-23-47-43/" data-orig-file="https://i0.wp.com/rizkypratama.id/wp-content/uploads/2018/06/Screen-Shot-2018-06-13-at-23.47.43.png?fit=1063%2C542&;ssl=1" data-orig-size="1063,542" data-comments-opened="1" data-image-meta="{";aperture";:";0";,";credit";:";";,";camera";:";";,";caption";:";";,";created_timestamp";:";0";,";copyright";:";";,";focal_length";:";0";,";iso";:";0";,";shutter_speed";:";0";,";title";:";";,";orientation";:";0";}" data-image-title="Screen Shot 2018-06-13 at 23.47.43" data-image-description="" data-image-caption="" data-medium-file="https://i0.wp.com/rizkypratama.id/wp-content/uploads/2018/06/Screen-Shot-2018-06-13-at-23.47.43.png?fit=300%2C153&;ssl=1" data-large-file="https://i0.wp.com/rizkypratama.id/wp-content/uploads/2018/06/Screen-Shot-2018-06-13-at-23.47.43.png?fit=810%2C413&;ssl=1" class="alignnone wp-image-518 size-full" src="https://rizkypratama.id/wp-content/uploads/2018/06/Screen-Shot-2018-06-13-at-23.47.43.png" alt="" width="1063" height="542" /></p>
<p>Terima kasih</p>
<p>Semoga bermanfaat</p>
<div class="saboxplugin-wrap" itemtype="http://schema.org/Person" itemscope itemprop="author"><div class="saboxplugin-tab"><div class="saboxplugin-gravatar"><img src="https://rizkypratama.id/wp-content/uploads/2020/09/My-Photos.jpg" width="100" height="100" alt="My Photos" itemprop="image"></div><div class="saboxplugin-authorname"><a href="https://rizkypratama.id/blog/author/rizky/" class="vcard author" rel="author"><span class="fn">Rizky Pratama</span></a></div><div class="saboxplugin-desc"><div itemprop="description"><p>Rizky Pratama. Tinggal di Bekasi, Jawa Barat. Seorang IT di salah satu perusahaan IT. Pengguna Mac, Linux dan Windows<br />
Selain sebagai penulis di blog ini, saya juga penulis di blog saya yang lain, yaitu <a href="https://pratama.biz.id" target="_blank" rel="noopener noreferrer">https://pratama.biz.id</a></p>
</div></div><div class="saboxplugin-web "><a href="https://rizkypratama.id" target="_blank" >rizkypratama.id</a></div><div class="clearfix"></div><div class="saboxplugin-socials sabox-colored"><a title="Facebook" target="_blank" href="https://web.facebook.com/rizkypratama04" rel="nofollow noopener" class="saboxplugin-icon-color"><svg class="sab-facebook" viewBox="0 0 500 500.7" xml:space="preserve" xmlns="http://www.w3.org/2000/svg"><path class="st0" d="m499.4 250.9c0 9.9-0.6 19.7-1.7 29.2-0.1 0.6-0.1 1.1-0.2 1.7-0.8 6.3-1.8 12.4-3 18.5-0.2 1.1-0.5 2.2-0.7 3.3-1.2 5.6-2.6 11-4.2 16.5-23.4 81.3-87.1 145.6-168.2 169.8-4.5 1.3-9.1 2.6-13.7 3.7-7.6 1.8-15.4 3.3-23.3 4.4-5.5 0.8-11.1 1.3-16.7 1.7-0.8 0.1-1.6 0.1-2.4 0.1-5 0.3-10.1 0.4-15.2 0.4-137.8 0-249.4-111.6-249.4-249.3s111.6-249.4 249.4-249.4 249.3 111.7 249.3 249.4z" fill="#3b5998" /><path class="st1" d="m493.8 303.6c-1.2 5.6-2.6 11-4.2 16.5-23.4 81.3-87.1 145.6-168.2 169.8-4.5 1.3-9.1 2.6-13.7 3.7l-100.9-101 1.8-3.5 2.1-76.7-45.3-43.7 41.3-31 30-95.3 71.4-24.7 185.7 185.9z" /><path class="st2" d="M206.8,392.6V268.8h-41.5v-49.2h41.5v-38.8c0-42.1,25.7-65,63.3-65c18,0,33.5,1.4,38,1.9v44H282 c-20.4,0-24.4,9.7-24.4,24v33.9h46.1l-6.3,49.2h-39.8v123.8" /></svg></span></a><a title="Instagram" target="_blank" href="https://www.instagram.com/rzkyprtmaaa01/" rel="nofollow noopener" class="saboxplugin-icon-color"><svg class="sab-instagram" viewBox="0 0 500 500.7" xml:space="preserve" xmlns="http://www.w3.org/2000/svg"><path class="st0" d="m499.8 250.7c0 7.6-0.4 15.2-1 22.6-0.2 2.2-0.4 4.4-0.7 6.6-0.1 0.6-0.1 1.1-0.2 1.7-0.3 2.6-0.7 5.2-1.1 7.7-0.4 2.3-0.8 4.7-1.2 7 0 0.3-0.1 0.6-0.2 0.9-0.2 1-0.4 1.9-0.5 2.9-0.2 0.8-0.4 1.6-0.5 2.5-0.1 0.3-0.1 0.5-0.2 0.8-0.7 3.3-1.5 6.5-2.3 9.7-0.6 2.3-1.2 4.5-1.9 6.8-23.4 81.3-87.1 145.6-168.2 169.8-3 0.9-6.1 1.8-9.2 2.6-1.5 0.4-3 0.8-4.5 1.1-3.6 0.9-7.2 1.6-10.9 2.3-0.2 0-0.5 0.1-0.7 0.1l-3 0.6c-1.8 0.3-3.6 0.6-5.4 0.9-0.2 0-0.3 0.1-0.5 0.1-0.9 0.1-1.9 0.3-2.8 0.4-5.5 0.8-11.1 1.3-16.7 1.7-0.8 0.1-1.6 0.1-2.4 0.1-5 0.3-10.1 0.4-15.2 0.4-137.7 0-249.3-111.6-249.3-249.3s111.6-249.4 249.3-249.4 249.3 111.7 249.3 249.4z" fill="#405de6" /><path class="st1" d="m495.4 297.2c-0.2 1-0.4 1.9-0.5 2.9-0.2 0.8-0.4 1.6-0.5 2.5-0.1 0.3-0.1 0.5-0.2 0.8-0.7 3.3-1.5 6.5-2.3 9.7-0.6 2.3-1.2 4.5-1.9 6.8-23.4 81.3-87.1 145.6-168.2 169.8-3 0.9-6.1 1.8-9.2 2.6-1.5 0.4-3 0.8-4.5 1.1-3.6 0.9-7.2 1.6-10.9 2.3-0.2 0-0.5 0.1-0.7 0.1l-151.5-152.7v-147l9.2-27 14.8-14 33-8 70-5 80.5 11.7 142.9 143.4z" /><path class="st2" d="m252.7 192.1c-34.1 0-61.6 27.5-61.6 61.6s27.5 61.6 61.6 61.6 61.6-27.5 61.6-61.6-27.5-61.6-61.6-61.6zm0 101.6c-22 0-40-17.9-40-40s17.9-40 40-40 40 17.9 40 40-17.9 40-40 40zm78.5-104.1c0 8-6.4 14.4-14.4 14.4s-14.4-6.4-14.4-14.4 6.4-14.4 14.4-14.4c7.9 0 14.4 6.4 14.4 14.4zm40.7 14.6c-0.9-19.2-5.3-36.3-19.4-50.3-14-14-31.1-18.4-50.3-19.4-19.8-1.1-79.2-1.1-99.1 0-19.2 0.9-36.2 5.3-50.3 19.3s-18.4 31.1-19.4 50.3c-1.1 19.8-1.1 79.2 0 99.1 0.9 19.2 5.3 36.3 19.4 50.3s31.1 18.4 50.3 19.4c19.8 1.1 79.2 1.1 99.1 0 19.2-0.9 36.3-5.3 50.3-19.4 14-14 18.4-31.1 19.4-50.3 1.2-19.9 1.2-79.2 0-99zm-25.6 120.2c-4.2 10.5-12.3 18.6-22.8 22.8-15.8 6.3-53.3 4.8-70.8 4.8s-55 1.4-70.8-4.8c-10.5-4.2-18.6-12.3-22.8-22.8-6.3-15.8-4.8-53.3-4.8-70.8s-1.4-55 4.8-70.8c4.2-10.5 12.3-18.6 22.8-22.8 15.8-6.3 53.3-4.8 70.8-4.8s55-1.4 70.8 4.8c10.5 4.2 18.6 12.3 22.8 22.8 6.3 15.8 4.8 53.3 4.8 70.8s1.5 55.1-4.8 70.8z" /></svg></span></a><a title="User email" target="_self" href="mailto:r&#105;z&#107;y&#064;r&#105;zkyp&#114;ata&#109;&#097;.&#105;d" rel="nofollow noopener" class="saboxplugin-icon-color"><svg class="sab-user_email" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 500 500.7"><path class="st0" d="M499.4 250.9c0 2.2 0 4.4-0.1 6.6v0.4c-0.1 1.8-0.2 3.6-0.2 5.3 0 0.4 0 0.8-0.1 1.2 -0.1 1.3-0.1 2.6-0.2 4 -0.1 1.7-0.2 3.3-0.4 5 0 0.2 0 0.4-0.1 0.6 -0.2 2-0.4 4.1-0.6 6.1 -0.1 0.6-0.1 1.1-0.2 1.7 -0.7 4.4-1.3 8.8-2 13.2 0 0.4-0.1 0.7-0.2 1v0.3c-0.2 1-0.4 2-0.5 3 0 0.1 0 0.2-0.1 0.3v0.1c0 0.2-0.1 0.4-0.1 0.6 -0.1 0.5-0.2 1-0.3 1.6 0 0.2-0.1 0.3-0.1 0.5 -0.6 2.6-1.2 5.2-1.8 7.8 -0.4 1.8-0.9 3.6-1.3 5.5 -0.2 0.9-0.5 1.9-0.8 2.8 -0.2 0.6-0.3 1.1-0.5 1.7 -0.8 2.7-1.6 5.3-2.5 8 -1.4 4.2-2.8 8.5-4.4 12.5 -0.1 0.4-0.3 0.7-0.4 1.1 -0.9 2.3-1.8 4.6-2.8 6.8 -28.1 66.2-84.2 117.8-153.5 140 -0.5 0.2-0.9 0.3-1.3 0.4 -1.1 0.4-2.2 0.7-3.3 1 -2.9 0.9-5.9 1.6-8.8 2.4 -0.1 0-0.2 0.1-0.3 0.1 -0.4 0.1-0.7 0.2-1.1 0.3 -1 0.3-2.1 0.6-3.1 0.8 -1 0.3-2 0.5-3.1 0.6 -0.1 0-0.2 0-0.3 0.1 -1 0.2-1.9 0.4-2.9 0.7 -0.3 0.1-0.7 0.2-1 0.2 -0.2 0.1-0.5 0.1-0.7 0.2 -1.5 0.3-2.9 0.5-4.3 0.8 -0.6 0.1-1.3 0.2-1.9 0.4 -0.2 0-0.3 0.1-0.5 0.1 -1.1 0.2-2.2 0.4-3.3 0.6 -1.2 0.2-2.4 0.4-3.5 0.5 -0.7 0.1-1.4 0.2-2.1 0.3 -0.3 0-0.5 0.1-0.8 0.1 -2.7 0.4-5.5 0.7-8.2 1 -0.3 0-0.7 0.1-1 0.1 -0.1 0-0.1 0-0.2 0 -1.1 0.1-2.1 0.2-3.2 0.3 -0.1 0-0.1 0-0.2 0 -1 0.1-2.1 0.2-3.2 0.2 -0.8 0.1-1.6 0.1-2.4 0.1 -1.4 0.1-2.9 0.2-4.4 0.2 -3.6 0.1-7.2 0.2-10.8 0.2 -4.3 0-8.7-0.1-13-0.3C105.4 493.1 0.7 384.3 0.7 250.9 0.7 113.2 112.3 1.5 250.1 1.5c129.3 0 235.3 98.2 248 223.9 0.5 4.4 0.8 8.9 1 13.3 0.1 1.5 0.1 3 0.2 4.6C499.4 245.8 499.4 248.4 499.4 250.9z" fill="#F97E2A" /><path class="st1" d="M499.1 263.2c0 0.4 0 0.8-0.1 1.2 -0.1 1.3-0.1 2.6-0.2 4 -0.1 1.7-0.2 3.3-0.4 5 0 0.2 0 0.4-0.1 0.6 -0.2 2-0.4 4.1-0.6 6.1 -0.1 0.6-0.1 1.1-0.2 1.7 -0.7 4.4-1.3 8.8-2 13.2 0 0.4-0.1 0.7-0.2 1v0.3c-0.2 1-0.4 2-0.5 3 0 0.1 0 0.2-0.1 0.3v0.1c0 0.2-0.1 0.4-0.1 0.6 -0.1 0.5-0.2 1-0.3 1.6 0 0.2-0.1 0.3-0.1 0.5 -0.6 2.6-1.2 5.2-1.8 7.8 -0.4 1.8-0.9 3.6-1.3 5.5 -0.2 0.9-0.5 1.9-0.8 2.8 -0.2 0.6-0.3 1.1-0.5 1.7 -0.8 2.7-1.6 5.3-2.5 8 -1.4 4.2-2.8 8.5-4.4 12.5 -0.1 0.4-0.3 0.7-0.4 1.1 -0.9 2.3-1.8 4.6-2.8 6.8 -28.1 66.2-84.2 117.8-153.5 140 -0.5 0.2-0.9 0.3-1.3 0.4 -1.1 0.4-2.2 0.7-3.3 1 -2.9 0.9-5.9 1.6-8.8 2.4 -0.1 0-0.2 0.1-0.3 0.1 -0.4 0.1-0.7 0.2-1.1 0.3 -1 0.3-2.1 0.6-3.1 0.8 -1 0.3-2 0.5-3.1 0.6 -0.1 0-0.2 0-0.3 0.1 -1 0.2-1.9 0.4-2.9 0.7 -0.3 0.1-0.7 0.2-1 0.2 -0.2 0.1-0.5 0.1-0.7 0.2 -1.5 0.3-2.9 0.5-4.3 0.8 -0.6 0.1-1.3 0.2-1.9 0.4 -0.2 0-0.3 0.1-0.5 0.1 -1.1 0.2-2.2 0.4-3.3 0.6 -1.2 0.2-2.4 0.4-3.5 0.5 -0.7 0.1-1.4 0.2-2.1 0.3 -0.3 0-0.5 0.1-0.8 0.1 -2.7 0.4-5.5 0.7-8.2 1 -0.3 0-0.7 0.1-1 0.1L119.9 344.1l105.3-46.7L119.9 191.6l265.6-41.2L499.1 263.2z" /><path class="st2" d="M390.1 214.1c2.1-1.7 5.3-0.1 5.3 2.6v112c0 14.5-11.8 26.3-26.3 26.3H141.2c-14.5 0-26.3-11.8-26.3-26.3v-112c0-2.7 3.1-4.3 5.3-2.6 12.3 9.5 28.5 21.6 84.4 62.2 11.6 8.4 31.1 26.2 50.5 26.1 19.6 0.2 39.4-18 50.6-26.1C361.6 235.7 377.8 223.6 390.1 214.1zM255.1 284.8c12.7 0.2 31-16 40.2-22.7 72.7-52.8 78.2-57.4 95-70.5 3.2-2.5 5-6.3 5-10.4v-10.4c0-14.5-11.8-26.3-26.3-26.3H141.2c-14.5 0-26.3 11.8-26.3 26.3v10.4c0 4.1 1.9 7.8 5 10.4 16.8 13.1 22.3 17.7 95 70.5C224.1 268.8 242.4 285 255.1 284.8L255.1 284.8z" /></svg></span></a></div></div></div>
Beberapa hari yang lalu saat saya sedang scroll timeline X (Twitter) saya menemukan sebuah postingan…
Beberapa waktu lalu saya ada migrasi dan upgrade beberapa server, salah satunya server postfix. Server…
Pada bulan April 2024 lalu, Ubuntu telah release versi terbaru yaitu Ubuntu 24.04 LTS, sehingga…
Ngga nyangka akhirnya saya bisa login kembali ke blog saya yang sudah berdebu ini, kali…
Beberapa waktu lalu, Excellent mendapatkan project migrasi Zimbra dari versi Open Source Ke Zimbra Network…
Bulan Oktober 2022 lalu, Apple resmi release MacOS terbaru mereka, yaitu MacOS Ventura. Beberapa fitur…