- SSLEngine on
- SSLCertificateFile /path/to/certificate
- SSLCertificateKeyFile /path/to/private/key
-
- LogLevel warn
- ErrorLog /var/log/apache2/error.log
- CustomLog /var/log/apache2/access.log combined
+ # SSL/TLS configuration for Let's Encrypt certificates acquired with certbot standalone
+ SSLEngine on
+ SSLCertificateFile /etc/letsencrypt/live/shaarli.mydomain.org/fullchain.pem
+ SSLCertificateKeyFile /etc/letsencrypt/live/shaarli.mydomain.org/privkey.pem
+ # Let's Encrypt settings from https://github.com/certbot/certbot/blob/master/certbot-apache/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf
+ SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+ SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+ SSLHonorCipherOrder off
+ SSLSessionTickets off
+ SSLOptions +StrictRequire
+
+ # SSL/TLS configuration for self-signed certificates
+ #SSLEngine on
+ #SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
+ #SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key