1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
// {{output.header}}
// {{{output.link}}}
package main
import (
"crypto/tls"
"log"
"net/http"
{{#if form.hsts}}
"time"
{{/if}}
)
func main() {
mux := http.NewServeMux()
mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
{{#if form.hsts}}
w.Header().Add("Strict-Transport-Security", "max-age={{output.hstsMaxAge}}")
{{/if}}
w.Write([]byte("This server is running the Mozilla {{form.config}} configuration.\n"))
})
{{#if form.hsts}}
go func() {
redirectToHTTPS := func(w http.ResponseWriter, req *http.Request) {
http.Redirect(w, req, "https://"+req.Host+req.RequestURI, http.StatusMovedPermanently)
}
srv := &http.Server{
Handler: http.HandlerFunc(redirectToHTTPS),
ReadTimeout: 60 * time.Second, WriteTimeout: 60 * time.Second,
}
log.Fatal(srv.ListenAndServe())
}()
{{/if}}
{{#if output.ciphers.length}}
{{#if (includes "intermediate" form.config)}}
// Due to a lack of DHE support, you -must- use an ECDSA cert to support IE 11 on Windows 7
{{/if}}
{{/if}}
cfg := &tls.Config{
MinVersion: tls.{{#if (eq output.protocols.[0] "TLSv1")}}VersionTLS10{{else}}{{{replace output.protocols.[0] "TLSv1." "VersionTLS1"}}}{{/if}},
{{#if output.serverPreferredOrder}}
PreferServerCipherSuites: true,
{{/if}}
{{#if output.ciphers.length}}
CipherSuites: []uint16{
{{#each output.ciphers}}
tls.{{this}},
{{/each}}
},
{{/if}}
}
srv := &http.Server{
Addr: ":443",
Handler: mux,
TLSConfig: cfg,
// Consider setting ReadTimeout, WriteTimeout, and IdleTimeout
// to prevent connections from taking resources indefinitely.
}
log.Fatal(srv.ListenAndServeTLS(
"/path/to/signed_cert_plus_intermediates",
"/path/to/private_key",
))
}
|
