### LiteSpeed Web Server Users' Manual

##### Version 5.0 Rev. 1

- License Std / Ent
- Introduction
- Installation
- Administration
  - Service Manager
- Security
- Configuration
  - Server General
  - Server Tuning
  - Server Security
  - Request Filter
  - Page Cache
  - External Apps
  - Fast CGI App
  - Fast CGI Authorizer
  - LSAPI App
  - Servlet Engine
  - Web Server
  - Pipped logger
  - Load Balancer
  - Script Handler
  - Rack/Rails Settings
  - Listeners
  - Templates
  - Virtual Host Basic
  - Virtual Host General
  - Virtual Host Security
  - Rewrite
  - Context
  - Static Context
  - Java Web App Context
  - Servlet Context
  - Fast CGI Context
  - LSAPI Context
  - Proxy Context
  - CGI Context
  - Load Balancer Context
  - Redirect Context
  - Rack/Rails Context
  - Web Socket Proxy
  - Add-ons
  - Admin Server
  - Admin Listeners

# Listener General

#### Table of Contents

Listener Name
Description: A unique name for this listener.

IP Address
Description: Specifies the IP of this listener. All available IP addresses are listed. IPv6 addresses are enclosed in "[]". To listen on all IPv4 IP addresses, select ANY. To listen on all IPv4 and IPv6 IP addresses, select [ANY]. In order to serve both IPv4 and IPv6 clients, an IPv4-mapped IPv6 address should be used instead of a plain IPv4 address. An IPv4-mapped IPv6 address is written as [::FFFF:x.x.x.x].
Syntax: Select from drop down list
Tips: [Security] If your machine has multiple IPs on different sub-networks, you can select a specific IP to only allow traffic from the corresponding sub-network.

Port
Description: Specifies the TCP port of the listener. Only the super user ("root") can use ports lower than 1024. Port 80 is the default HTTP port. Port 443 is the default HTTPS port.
Syntax: Integer number

Binding
Description: Enterprise Edition Only Specifies which lshttpd child process the listener is assigned to. Enterprise Edition spawns multiple child processes to take advantage of the multiple CPUs in a SMP system. Different child processes can be used to handle requests to different listeners by manually associating a listener with a process. By default, a listener is assigned to all child processes.
Syntax: Select from checkbox

Secure
Description: Specifies whether this is a secure (SSL) listener. For secure listeners, additional SSL settings need to be set properly.
Syntax: Select from radio box

Virtual Host Mappings
Description: Specifies the relationship between the listener and virtual hosts. Listeners and virtual hosts are associated by domain names. An HTTP request will be routed to a virtual host with a matching domain name. One listener can map to multiple virtual hosts for different domain names. One virtual host can also be mapped from different listeners. One listener can allow one catchall virtual host with the domain name value "*". When there is no explicitly matched domain name in the listener's mapping, the listener will forward the request to that catchall virtual host.
Tips: [Performance] Only add necessary mappings. If the listener is mapped to only one virtual host, then only set up a catchall mapping "*".

Virtual Host
Description: Specifies the name of a virtual host.
Syntax: Select from drop down list

Domains
Description: Specifies the mapping domain names. Domain names are case insensitive and the leading "www." will be removed. The wildcard characters "*" and "?" are allowed. "?" only represents one character. "*" represents any numbers of characters. Duplicated domain names are not allowed.
Syntax: Comma-separated list.
Example: www?.example.com "*.mydomain.com" will match all subdomains of mydomain.com. "*" by itself is the catchall domain and will match any unmatched domain names.
Tips: [Performance] If a listener is dedicated to one virtual host, always use * for the domain name to avoid unnecessary checking. Domain names with wildcard characters (other than the catchall domain) should be avoided whenever possible.

SSL Private Key & Certificate
Description: Every SSL listener requires a paired SSL private key and SSL certificate. Multiple SSL listeners can share the same key and certificate. You can generate SSL private keys yourself using an SSL software package, such as OpenSSL. SSL certificates can also be purchased from an authorized certificate issuer like VeriSign or Thawte. You can also sign the certificate yourself. That certificate will not be trusted by web browsers and should not be used on public web sites containing critical data. However, a self-signed certificate is good enough for internal use, e.g. for encrypting traffic to LiteSpeed Web Server's WebAdmin console.

Private Key File
Description: Specifies the file name of the SSL private key file. The key file should not be encrypted.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.
Tips: [Security] The private key file should be placed in a secured directory that allows read-only access to the user the server runs as.

Certificate File
Description: Specifies the file name of the SSL certificate file.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.
Tips: [Security] The certificate file should be placed in a secured directory, which allows read-only access to the user that the server runs as.

Chained Certificate
Description: Specifies whether the certificate is a chained certificate or not. The file that stores a certificate chain must be in PEM format, and the certificates must be in the chained order, from the lowest level (the actual client or server certificate) to the highest level (root) CA.
Syntax: Select from radio box

CA Certificate Path
Description: Specifies the directory where the certificates of certification authorities (CAs) are kept. Those certificates are used for client certificate authentication and constructing the server certificate chain, which will be sent to browsers in addition to the server certificate.
Syntax: path

CA Certificate File
Description: Specifies the file that contains all certificates of certification authorities (CAs) for chained certificates. This file is simply the concatenation of PEM-encoded certificate files, in order of preference. This can be used as an alternative or in addition to CA Certificate Path. Those certificates are used for client certificate authentication and constructing the server certificate chain, which will be sent to browsers in addition to the server certificate.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.

SSL Protocol
Description: Customizes SSL protocols accepted by the listener.

Protocol Version
Description: Specifies which version of SSL protocol will be used. You can choose from SSL v3.0 and TLS v1.0. Since OpenSSL 1.0.1, TLS v1.1 and TLS v1.2 are also supported.

Ciphers
Description: Specifies the cipher suite to be used to negotiate the SSL handshake. LSWS supports cipher suites implemented in SSL v3.0, TLS v1.0, and TLS v1.2.
Syntax: Colon-separated string of cipher specifications. LSWS supports all cipher suites implemented in SSL v3.0, TLS v1.0, and TLS v1.2.
Example: ECDHE-RSA-AES128-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
Tips: [Security] We recommend ECDHE-RSA-AES128-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Enable ECDH Key Exchange
Description: Allows use of Elliptic Curve Diffie-Hellman key exchange for further SSL encryption.
Syntax: Select from radio box
Tips: [Security] ECDH key exchange is more secure than using just an RSA key. ECDH and DH key exchange are equally secure. [Performance] Enabling ECDH key exchange will increase CPU load and is slower than using just an RSA key.

Enable DH Key Exchange
Description: Allows use of Diffie-Hellman key exchange for further SSL encryption.
Syntax: Select from radio box
Tips: [Security] DH key exchange is more secure than using just an RSA key. ECDH and DH key exchange are equally secure. [Performance] Enabling DH key exchange will increase CPU load and is slower than ECDH key exchange and RSA. ECDH key exchange is preferred when available.

DH Parameter
Description: Specifies the location of the Diffie-Hellman parameter file necessary for DH key exchange.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.

SSL Renegotiation Protection
Description: Specifies whether to enable SSL Renegotiation Protection to defend against SSL handshake-based attacks. The default value is "Yes".
Syntax: Select from radio box

Enable SPDY/HTTP2
Description: HTTP/2 and SPDY are new versions of the HTTP network protocol with the goal of reducing page load times. More information can be found at: http://en.wikipedia.org/wiki/HTTP/2
Syntax: Check the protocol(s) you wish to enable. Leaving all boxes unchecked will enable SPDY and HTTP/2 support (the default). If you wish to disable SPDY and HTTP/2, check "None" only and leave all other boxes unchecked.

OCSP Stapling
Description: Online Certificate Status Protocol (OCSP) is a more efficient method of checking whether a digital certificate is valid. It works by communicating with another server — the OCSP responder — to get verification that the certificate is valid instead of checking through certificate revocation lists (CRL). OCSP stapling is a further improvement on this protocol, allowing the server to check with the OCSP responder at regular intervals instead of every time a certificate is requested. See the OCSP Wikipedia page for more details.

Enable OCSP Stapling
Description: Determines whether to enable OCSP stapling, a more efficient way of verifying public key certificates.
Syntax: Select from radio box

OCSP Response Max Age (secs)
Description: This option sets the maximum allowable age for an OCSP response. If an OCSP response is older than this maximum age, the server will contact the OCSP responder for a new response. The default value is 86400. Maximum age can be turned off by setting this value to -1.
Syntax: Integer of seconds

OCSP Responder
Description: Specifies the URL of the OCSP responder to be used. If not set, the server will attempt to contact the OCSP responder detailed in the certificate authority's issuer certificate. Some issuer certificates may not have an OCSP responder URL specified.
Syntax: URL starting with http://
Example: http://rapidssl-ocsp.geotrust.com

OCSP CA Certificates
Description: Specifies the location of the file where OCSP certificate authority (CA) certificates are stored. These certificates are used to check responses from the OCSP responder (and make sure those responses are not spoofed or otherwise compromised). This file should contain the whole certificate chain. If this file does not contain the root certificate, LSWS should be able to find the root certificate in your system directory without you adding it to the file, but, if this validation fails, you should try adding your root certificate to this file. This setting is optional. If this setting is not set, the server will automatically check CA Certificate File.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.

Client Verification
Description: Enterprise Edition Only Specifies the type of client certifcate authentication. Available types are: None: No client certificate is required. Optional: Client certificate is optional. Require: The client must has valid certificate. Optional_no_ca: Same as optional. The default is "None".
Syntax: Select from drop down list
Tips: "None" or "Require" are recommended.

Verify Depth
Description: Enterprise Edition Only Specifies how deeply a certificate should be verified before determining that the client does not have a valid certificate. The default is "1".
Syntax: Select from drop down list

Client Revocation Path
Description: Enterprise Edition Only Specifies the directory containing PEM-encoded CA CRL files for revoked client certificates. The files in this directory have to be PEM-encoded. These files are accessed through hash file names, hash-value.rN. Please refer to openSSL or Apache mod_ssl documentation regarding creating the hash filename.
Syntax: path

Client Revocation File
Description: Enterprise Edition Only Specifies the file containing PEM-encoded CA CRL files enumerating revoked client certificates. This can be used as an alternative or in addition to Client Revocation Path.
Syntax: File name which can be an absolute path or relative to $SERVER_ROOT.