Ubuntu 16.04 Apache2 HTTP/2, HSTS : Steps + Configuration

As we said before – we are no longer supporting to install, configure Nginx but we are back to support Apache2 mainly for their odd idea to involve community to develop modules for free and distribute with paid product. Additionally, Nginx 502 error is a nightmare. Apache2 at current cost of web hosting not exactly bad. Here is a full working guided steps to setup Ubuntu 16.04 Apache2 HTTP/2, HSTS easily.

 

Ubuntu 16.04 Apache2 HTTP/2, HSTS : Steps

 

We will use ondrej’s repository for Apache2, first update and add the repo :

After adding the repo, again update and install Apache2 :

To activate the http2 module, simply run :

Next restart Apache2 :

For practical reasons, we need SSL/HTTPS, so we will take it granted that you did these steps :

And for free SSL/TLS certificate, you have done something like these :

To generate SSL certificates against your domains you did these :

Then had a restart :

You essentially can open your website’s HTTPS version on browser without warning. If your virtual host configuration file’s name is 000-default-le-ssl.conf with this (partial) content :

You should add this line :

here :

Ans restart Apache2 after config test :

Now, if you test somewhere for HTTP/2, you’ll get it. For adding different headers, you need to activate a module :

and restart Apache2 :

We already talked about HSTS in context of Nginx.

The configuration for HSTS should look like this :

and restart Apache2 :

 

Example Virtual Hosts Configuration File For Ubuntu 16.04 Apache2 HTTP/2, HSTS

 

It is an example modern, secured setup :

We kept other settings on /etc/letsencrypt/options-ssl-apache.conf file. Which essentially has :

In case we want to enable HTTP Public Key Pinning (HPKP), Expect-CT etc headers, we will add headers in this fashion :

Quite simple. Test on SSL Lab and Security Headers like easy to test sites :

Of course you can use HTTP/2 server push feature with Apache2. Please read the official docs on Apache’s site for more information.

Tagged With ubuntu apache2 xss block , https://yandex ru/clck/jsredir?from=yandex ru;search;web;;&text=&etext=1838 OoPuoYiXGDb5ib0nYNPbeZS6pNnq6djlBSJNE-SNbINnvHC2SXESHhxS9_yHmn3J 9753a63031ae2c64fa0e00dde9e18cc20e3d6607&uuid=&state=_BLhILn4SxNIvvL0W45KSic66uCIg23qh8iRG98qeIXme , https://yandex ru/clck/jsredir?from=yandex ru;search;web;;&text=&etext=1824 xfocc2KLPQWl5uSXcgG9-2lkxuW8IHeSyab3d3_epJSUcuXj7eHXxPNjYNY_J6g2 19b258141e62443e33298fdbe777e685c0b132c9&uuid=&state=_BLhILn4SxNIvvL0W45KSic66uCIg23qh8iRG98qeIXme , Expect-CT letsencrypt , enforce https on apache2 ubuntu 16 04 , apache2 after http2 header edit set-cookie no longer working , Apache2 , apache ubuntu require hsts , apache hsts ubuntu , apache HSTS

This Article Has Been Shared 409 Times!

Facebook Twitter Pinterest