Apache SSL configuration generator

The Apache preset of the TLS config generator writes mod_ssl settings for Apache httpd. Pick the profile and options, copy the output into your site configuration (for example /etc/apache2/sites-available/example.com-ssl.conf or /etc/httpd/conf.d/ssl.conf), test with apachectl configtest and reload.

Example: intermediate profile

<VirtualHost *:80>
    ServerName example.com
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile      /etc/ssl/example.com/fullchain.pem
    SSLCertificateKeyFile   /etc/ssl/example.com/privkey.pem
    Protocols h2 http/1.1
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
</VirtualHost>

# global settings (outside <VirtualHost>)
SSLProtocol             -all +TLSv1.2 +TLSv1.3
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLOpenSSLConfCmd       Curves X25519:prime256v1:secp384r1
SSLHonorCipherOrder     off
SSLSessionTickets       off

Version requirements

• Apache 2.4.37+ with OpenSSL 1.1.1+ for TLS 1.3 (apachectl -V and openssl version).
• Apache 2.4.8+ to put the chain in SSLCertificateFile. Older versions need SSLCertificateChainFile chain.pem.
• mod_http2 for the Protocols h2 http/1.1 line; drop the line if the module is not available.
• X25519MLKEM768: replace the Curves line with SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1:secp384r1 when httpd links OpenSSL 3.5+.

Test and reload

sudo apachectl configtest && sudo systemctl reload apache2   # httpd on RHEL, Rocky, AlmaLinux

Common mistakes

• Duplicate SSLProtocol lines: distribution files such as ssl.conf or options-ssl-apache.conf (written by certbot) may set their own values. The last one read wins; search with grep -ri sslprotocol /etc/apache2 /etc/httpd.
• Header not sent: mod_headers is not enabled, or the header is in the port-80 VirtualHost only.
• Old chain file: after renewal SSLCertificateChainFile still points to an outdated intermediate. Use the full chain in SSLCertificateFile.