Initial http2 update

Author: custom-dev-tools

cipher-suite-black-list.txt

@@ -0,0 +1,279 @@
+Ref 1:    https://en.wikipedia.org/wiki/HTTP/2
+Ref 2:    https://http2.github.io/http2-spec/#BadCipherSuites
+
+TLS_NULL_WITH_NULL_NULL
+TLS_RSA_WITH_NULL_MD5
+TLS_RSA_WITH_NULL_SHA
+TLS_RSA_EXPORT_WITH_RC4_40_MD5
+TLS_RSA_WITH_RC4_128_MD5
+TLS_RSA_WITH_RC4_128_SHA
+TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+TLS_RSA_WITH_IDEA_CBC_SHA
+TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
+TLS_RSA_WITH_DES_CBC_SHA
+TLS_RSA_WITH_3DES_EDE_CBC_SHA
+TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
+TLS_DH_DSS_WITH_DES_CBC_SHA
+TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
+TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
+TLS_DH_RSA_WITH_DES_CBC_SHA
+TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
+TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
+TLS_DHE_DSS_WITH_DES_CBC_SHA
+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
+TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
+TLS_DHE_RSA_WITH_DES_CBC_SHA
+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
+TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
+TLS_DH_anon_WITH_RC4_128_MD5
+TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
+TLS_DH_anon_WITH_DES_CBC_SHA
+TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
+TLS_KRB5_WITH_DES_CBC_SHA
+TLS_KRB5_WITH_3DES_EDE_CBC_SHA
+TLS_KRB5_WITH_RC4_128_SHA
+TLS_KRB5_WITH_IDEA_CBC_SHA
+TLS_KRB5_WITH_DES_CBC_MD5
+TLS_KRB5_WITH_3DES_EDE_CBC_MD5
+TLS_KRB5_WITH_RC4_128_MD5
+TLS_KRB5_WITH_IDEA_CBC_MD5
+TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
+TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA
+TLS_KRB5_EXPORT_WITH_RC4_40_SHA
+TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
+TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5
+TLS_KRB5_EXPORT_WITH_RC4_40_MD5
+TLS_PSK_WITH_NULL_SHA
+TLS_DHE_PSK_WITH_NULL_SHA
+TLS_RSA_PSK_WITH_NULL_SHA
+TLS_RSA_WITH_AES_128_CBC_SHA
+TLS_DH_DSS_WITH_AES_128_CBC_SHA
+TLS_DH_RSA_WITH_AES_128_CBC_SHA
+TLS_DHE_DSS_WITH_AES_128_CBC_SHA
+TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+TLS_DH_anon_WITH_AES_128_CBC_SHA
+TLS_RSA_WITH_AES_256_CBC_SHA
+TLS_DH_DSS_WITH_AES_256_CBC_SHA
+TLS_DH_RSA_WITH_AES_256_CBC_SHA
+TLS_DHE_DSS_WITH_AES_256_CBC_SHA
+TLS_DHE_RSA_WITH_AES_256_CBC_SHA
+TLS_DH_anon_WITH_AES_256_CBC_SHA
+TLS_RSA_WITH_NULL_SHA256
+TLS_RSA_WITH_AES_128_CBC_SHA256
+TLS_RSA_WITH_AES_256_CBC_SHA256
+TLS_DH_DSS_WITH_AES_128_CBC_SHA256
+TLS_DH_RSA_WITH_AES_128_CBC_SHA256
+TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
+TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
+TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
+TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
+TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
+TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
+TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+TLS_DH_DSS_WITH_AES_256_CBC_SHA256
+TLS_DH_RSA_WITH_AES_256_CBC_SHA256
+TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
+TLS_DH_anon_WITH_AES_128_CBC_SHA256
+TLS_DH_anon_WITH_AES_256_CBC_SHA256
+TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
+TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
+TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
+TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
+TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
+TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
+TLS_PSK_WITH_RC4_128_SHA
+TLS_PSK_WITH_3DES_EDE_CBC_SHA
+TLS_PSK_WITH_AES_128_CBC_SHA
+TLS_PSK_WITH_AES_256_CBC_SHA
+TLS_DHE_PSK_WITH_RC4_128_SHA
+TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
+TLS_DHE_PSK_WITH_AES_128_CBC_SHA
+TLS_DHE_PSK_WITH_AES_256_CBC_SHA
+TLS_RSA_PSK_WITH_RC4_128_SHA
+TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
+TLS_RSA_PSK_WITH_AES_128_CBC_SHA
+TLS_RSA_PSK_WITH_AES_256_CBC_SHA
+TLS_RSA_WITH_SEED_CBC_SHA
+TLS_DH_DSS_WITH_SEED_CBC_SHA
+TLS_DH_RSA_WITH_SEED_CBC_SHA
+TLS_DHE_DSS_WITH_SEED_CBC_SHA
+TLS_DHE_RSA_WITH_SEED_CBC_SHA
+TLS_DH_anon_WITH_SEED_CBC_SHA
+TLS_RSA_WITH_AES_128_GCM_SHA256
+TLS_RSA_WITH_AES_256_GCM_SHA384
+TLS_DH_RSA_WITH_AES_128_GCM_SHA256
+TLS_DH_RSA_WITH_AES_256_GCM_SHA384
+TLS_DH_DSS_WITH_AES_128_GCM_SHA256
+TLS_DH_DSS_WITH_AES_256_GCM_SHA384
+TLS_DH_anon_WITH_AES_128_GCM_SHA256
+TLS_DH_anon_WITH_AES_256_GCM_SHA384
+TLS_PSK_WITH_AES_128_GCM_SHA256
+TLS_PSK_WITH_AES_256_GCM_SHA384
+TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
+TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
+TLS_PSK_WITH_AES_128_CBC_SHA256
+TLS_PSK_WITH_AES_256_CBC_SHA384
+TLS_PSK_WITH_NULL_SHA256
+TLS_PSK_WITH_NULL_SHA384
+TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
+TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
+TLS_DHE_PSK_WITH_NULL_SHA256
+TLS_DHE_PSK_WITH_NULL_SHA384
+TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
+TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
+TLS_RSA_PSK_WITH_NULL_SHA256
+TLS_RSA_PSK_WITH_NULL_SHA384
+TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256
+TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256
+TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256
+TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
+TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256
+TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256
+TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256
+TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
+TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256
+TLS_EMPTY_RENEGOTIATION_INFO_SCSV
+TLS_ECDH_ECDSA_WITH_NULL_SHA
+TLS_ECDH_ECDSA_WITH_RC4_128_SHA
+TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+TLS_ECDHE_ECDSA_WITH_NULL_SHA
+TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+TLS_ECDH_RSA_WITH_NULL_SHA
+TLS_ECDH_RSA_WITH_RC4_128_SHA
+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+TLS_ECDHE_RSA_WITH_NULL_SHA
+TLS_ECDHE_RSA_WITH_RC4_128_SHA
+TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+TLS_ECDH_anon_WITH_NULL_SHA
+TLS_ECDH_anon_WITH_RC4_128_SHA
+TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
+TLS_ECDH_anon_WITH_AES_128_CBC_SHA
+TLS_ECDH_anon_WITH_AES_256_CBC_SHA
+TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA
+TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA
+TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA
+TLS_SRP_SHA_WITH_AES_128_CBC_SHA
+TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA
+TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA
+TLS_SRP_SHA_WITH_AES_256_CBC_SHA
+TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA
+TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA
+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
+TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
+TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
+TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
+TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
+TLS_ECDHE_PSK_WITH_RC4_128_SHA
+TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
+TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
+TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
+TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
+TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
+TLS_ECDHE_PSK_WITH_NULL_SHA
+TLS_ECDHE_PSK_WITH_NULL_SHA256
+TLS_ECDHE_PSK_WITH_NULL_SHA384
+TLS_RSA_WITH_ARIA_128_CBC_SHA256
+TLS_RSA_WITH_ARIA_256_CBC_SHA384
+TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256
+TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384
+TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256
+TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384
+TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256
+TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384
+TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256
+TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384
+TLS_DH_anon_WITH_ARIA_128_CBC_SHA256
+TLS_DH_anon_WITH_ARIA_256_CBC_SHA384
+TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256
+TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384
+TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256
+TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384
+TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256
+TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384
+TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256
+TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384
+TLS_RSA_WITH_ARIA_128_GCM_SHA256
+TLS_RSA_WITH_ARIA_256_GCM_SHA384
+TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256
+TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384
+TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256
+TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384
+TLS_DH_anon_WITH_ARIA_128_GCM_SHA256
+TLS_DH_anon_WITH_ARIA_256_GCM_SHA384
+TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256
+TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384
+TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256
+TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384
+TLS_PSK_WITH_ARIA_128_CBC_SHA256
+TLS_PSK_WITH_ARIA_256_CBC_SHA384
+TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256
+TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384
+TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256
+TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384
+TLS_PSK_WITH_ARIA_128_GCM_SHA256
+TLS_PSK_WITH_ARIA_256_GCM_SHA384
+TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256
+TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384
+TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
+TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
+TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
+TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
+TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
+TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
+TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
+TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256
+TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384
+TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256
+TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384
+TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256
+TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384
+TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
+TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
+TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
+TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
+TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
+TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
+TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
+TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
+TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
+TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
+TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+TLS_RSA_WITH_AES_128_CCM
+TLS_RSA_WITH_AES_256_CCM
+TLS_RSA_WITH_AES_128_CCM_8
+TLS_RSA_WITH_AES_256_CCM_8
+TLS_PSK_WITH_AES_128_CCM
+TLS_PSK_WITH_AES_256_CCM
+TLS_PSK_WITH_AES_128_CCM_8
+TLS_PSK_WITH_AES_256_CCM_8

ssl_config.bat

@@ -738,7 +738,7 @@ for /l %%a in (1,1,%$totalApacheVersionsInstalled%) do (
 
 
     rem --------------------------------------------
-    rem  Uncomment 'socache_shmcb_modules' module
+    rem  Uncomment 'socache_shmcb_module' module
     rem
     rem  Low level shared memory based object cache
     rem  for caching information such as SSL
@@ -757,13 +757,14 @@ for /l %%a in (1,1,%$totalApacheVersionsInstalled%) do (
     )
 
 
-    rem -----------------------------------------
-    rem  Uncomment 'ssl_module_modules' module
+    rem -------------------------------
+    rem  Uncomment 'ssl_module' module
     rem
-    rem  This module used the socache interface
-    rem  to provide a session cache and stapling
+    rem  This module used the socache
+    rem  interface to provide a
+    rem  session cache and stapling
     rem  cache.
-    rem -----------------------------------------
+    rem -------------------------------
 
     rem Check if the module is commented out / disabled.
     call :findInFile "]#LoadModule ssl_module modules/mod_ssl.so" "!$installedApacheVersionPathsArray[%%a]!\conf\httpd.conf"
@@ -776,6 +777,30 @@ for /l %%a in (1,1,%$totalApacheVersionsInstalled%) do (
         call :logToBoth "    'ssl_module' already uncommented."
     )
 
+    rem -----------------------------------------
+    rem  Uncomment 'http2_module' module
+    rem
+    rem  This module enables HTTP/2 support.
+    rem
+    rem  OpenSSL version must be greater than or
+    rem  equal to 1.0.2 for HTTP/2 compatibility.
+    rem
+    rem  OpenSSL cipher suite must be greater
+    rem  than or equal to TLS 1.3 for HTTP/2
+    rem  compatibility.
+    rem -----------------------------------------
+
+    rem Check if the module is commented out / disabled.
+    call :findInFile "]#LoadModule http2_module modules/mod_http2.so" "!$installedApacheVersionPathsArray[%%a]!\conf\httpd.conf"
+    if /i "!$result!" equ "true" (
+        rem Uncomment / enable the module.
+        call :findAndReplaceInFile "]#LoadModule http2_module modules/mod_http2.so" "]LoadModule http2_module modules/mod_http2.so" "!$installedApacheVersionPathsArray[%%a]!\conf\httpd.conf"
+        call :logToBoth "    'http2_module' uncommented."
+    ) else (
+        rem Module already uncommented / enabled.
+        call :logToBoth "    'http2_module' already uncommented."
+    )
+
 
     rem ----------------------------------------
     rem  Add vhosts HTTPS 'httpd-ssl.conf' link