Merge pull request #1788 from hjf288/GIT-1682

GIT-1682: Complete the SSL configuration section of the documentation…

doc/install/Production-Debian.md

@@ -225,6 +225,7 @@ exit 0
 ```
    server {
       server_name mattermost.example.com;
+
       location / {
          client_max_body_size 50M;
          proxy_set_header Upgrade $http_upgrade;
@@ -234,7 +235,7 @@ exit 0
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Frame-Options SAMEORIGIN;
-          proxy_pass http://localhost:8065;
+         proxy_pass http://10.10.10.2:8065;
       }
    }
 ```
@@ -264,8 +265,8 @@ exit 0
     Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com
     Email Address []:admin@mattermost.example.com
 ```
-1. Modify the file at `/etc/nginx/sites-available/mattermost` and add the following lines
+1. Run `openssl dhparam -out dhparam.pem 4096` (it will take some time).
-  * 
+1. Modify the file at `/etc/nginx/sites-available/mattermost` and add the following lines:
 ```
   server {
      listen         80;
@@ -278,18 +279,29 @@ exit 0
      server_name mattermost.example.com;
 
      ssl on;
-        ssl_certificate /home/mattermost/cert/mattermost.crt;
+     ssl_certificate /home/ubuntu/cert/mattermost.crt;
-        ssl_certificate_key /home/mattermost/cert/mattermost.key;
+     ssl_certificate_key /home/ubuntu/cert/mattermost.key;
+     ssl_dhparam /home/ubuntu/cert/dhparam.pem;
      ssl_session_timeout 5m;
-        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
+     ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
      ssl_prefer_server_ciphers on;
      ssl_session_cache shared:SSL:10m;
 
-		# add to location / above
      location / {
         gzip off;
         proxy_set_header X-Forwarded-Ssl on;
+        client_max_body_size 50M;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Frame-Options SAMEORIGIN;
+        proxy_pass http://10.10.10.2:8065;
+     }
+  }
 ```
 
 

doc/install/Production-RHEL6.md

@@ -125,6 +125,7 @@ enabled=1
 ```
    server {
       server_name mattermost.example.com;
+
       location / {
          client_max_body_size 50M;
          proxy_set_header Upgrade $http_upgrade;
@@ -164,8 +165,8 @@ enabled=1
     Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com
     Email Address []:admin@mattermost.example.com
 ```
+1. Run `openssl dhparam -out dhparam.pem 4096` (it will take some time).
 1. Modify the file at `/etc/nginx/conf.d/mattermost.conf` and add the following lines
-  * 
 ```
   server {
      listen         80;
@@ -178,18 +179,29 @@ enabled=1
      server_name mattermost.example.com;
 
      ssl on;
-        ssl_certificate /opt/mattermost/cert/mattermost.crt;
+     ssl_certificate /home/ubuntu/cert/mattermost.crt;
-        ssl_certificate_key /opt/mattermost/cert/mattermost.key;
+     ssl_certificate_key /home/ubuntu/cert/mattermost.key;
+     ssl_dhparam /home/ubuntu/cert/dhparam.pem;
      ssl_session_timeout 5m;
-        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
+     ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
      ssl_prefer_server_ciphers on;
      ssl_session_cache shared:SSL:10m;
 
-    # add to location / above
      location / {
         gzip off;
         proxy_set_header X-Forwarded-Ssl on;
+        client_max_body_size 50M;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Frame-Options SAMEORIGIN;
+        proxy_pass http://10.10.10.2:8065;
+     }
+  }
 ```
 
 ## Finish Mattermost Server setup

doc/install/Production-RHEL7.md

@@ -132,6 +132,7 @@ enabled=1
 ```
    server {
       server_name mattermost.example.com;
+
       location / {
          client_max_body_size 50M;
          proxy_set_header Upgrade $http_upgrade;
@@ -171,8 +172,8 @@ enabled=1
     Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com
     Email Address []:admin@mattermost.example.com
 ```
+1. Run `openssl dhparam -out dhparam.pem 4096` (it will take some time).
 1. Modify the file at `/etc/nginx/conf.d/mattermost.conf` and add the following lines
-  * 
 ```
   server {
      listen         80;
@@ -185,18 +186,29 @@ enabled=1
      server_name mattermost.example.com;
 
      ssl on;
-        ssl_certificate /opt/mattermost/cert/mattermost.crt;
+     ssl_certificate /home/ubuntu/cert/mattermost.crt;
-        ssl_certificate_key /opt/mattermost/cert/mattermost.key;
+     ssl_certificate_key /home/ubuntu/cert/mattermost.key;
+     ssl_dhparam /home/ubuntu/cert/dhparam.pem;
      ssl_session_timeout 5m;
-        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
+     ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
      ssl_prefer_server_ciphers on;
      ssl_session_cache shared:SSL:10m;
 
-    # add to location / above
      location / {
         gzip off;
         proxy_set_header X-Forwarded-Ssl on;
+        client_max_body_size 50M;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Frame-Options SAMEORIGIN;
+        proxy_pass http://10.10.10.2:8065;
+     }
+  }
 ```
 
 ## Finish Mattermost Server setup

doc/install/Production-Ubuntu.md

@@ -108,6 +108,7 @@ exec bin/platform
 ```
    server {
       server_name mattermost.example.com;
+
       location / {
          client_max_body_size 50M;
          proxy_set_header Upgrade $http_upgrade;
@@ -170,10 +171,20 @@ exec bin/platform
      ssl_prefer_server_ciphers on;
      ssl_session_cache shared:SSL:10m;
 
-		# add to location / above
      location / {
         gzip off;
         proxy_set_header X-Forwarded-Ssl on;
+        client_max_body_size 50M;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Frame-Options SAMEORIGIN;
+        proxy_pass http://10.10.10.2:8065;
+     }
+  }
 ```