Configure 2048 bit DH parameters for nginx

diff --git a/cookbooks/ssl/files/default/dhparam.pem b/cookbooks/ssl/files/default/dhparam.pem
new file mode 100644 (file)
index 0000000..c895dd7
--- /dev/null
+++ b/cookbooks/ssl/files/default/dhparam.pem
@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEApDYHQhAm+Wje/kmAWAzCIOhzxJj6RjjKbOfsUp31PpBaeQKwdIZZ
+jStXfkdo1/c4FfpKczO4WMQJBJjCts6nmEfaPTq/ybcVtG0GQDwO6NIjM8sSymUF
+Qcnd9aH2jfUyciPqkAfTavvy+zZIU+3HxTvCA3I6JY5qLZ4YOpNheRu5Q9azBMLo
+vfb+6oQGMnMvUVCSU8aw8BQ1qwhzJJQNAszQqA3DrxG17jsk0mBzsR3KSs4eNcjx
++65YhKArG76J1NolcP1rocehK5nrH2IO3cU2G/m2Y09DkXSP9thRSxUQ7rVKSgbC
+KhA263146gEf+bbKdMf6zrsNpjisMZ62ewIBAg==
+-----END DH PARAMETERS-----

diff --git a/cookbooks/ssl/recipes/default.rb b/cookbooks/ssl/recipes/default.rb
index f5239e67bf394e0a01f09647c03afeae9726d2f7..f737fe1a6356e596508e98ca7e25d717f73a5f30 100644 (file)
--- a/cookbooks/ssl/recipes/default.rb
+++ b/cookbooks/ssl/recipes/default.rb
@@ -22,7 +22,7 @@ keys = data_bag_item("ssl", "keys")
 package "openssl"
 package "ssl-cert"
 
-%w(rapidssl startcom).each do |certificate|
+%w(rapidssl startcom dhparam).each do |certificate|
   cookbook_file "/etc/ssl/certs/#{certificate}.pem" do
     owner "root"
     group "root"

diff --git a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
index 20f94dcd7f58203e8376cd4a672c317eeba6e036..77e2c6fd0ceda40e876ce1d8a8ba57f09f21e233 100644 (file)
--- a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
@@ -13,6 +13,7 @@ server {
     ssl_session_cache shared:SSL:30m;
     ssl_session_timeout 15m;
     ssl_stapling on;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem;
     resolver <%= @resolvers.join(" ") %>;
 
     location / { proxy_pass http://127.0.0.1; proxy_set_header X-Forwarded-For $remote_addr; }