Guidelines on Securing Public Web Servers

Completed 

Action 

encryption, use self signed certificate 

For configurations that require server authentication and encryption, 

use third party issued certificate  

For configurations that require a medium level of client 

authentication, configure server to require username and password 

via SSL/TLS 

For configurations that require a high level of client authentication 

configure server to require client certificates via SSL/TLS 

Configure file integrity checker to monitor Web server certificate 

If only SSL /TLS is to be used on the Web server, ensure access via 

TCP port 80 is disabled 

If most traffic to the Web server will be via encrypted SSL/TLS, 

ensure that appropriate logging and detection mechanisms are 

employed on the Web server (because network monitoring is 

ineffective against encrypted SSL/TLS sessions) 

63