# Apache SSL Configuration Generator (mod_ssl, TLS 1.3)

> Secure Apache mod_ssl config: TLS 1.2/1.3, modern ciphers, HSTS, HTTP to HTTPS redirect and http2, with version requirements.

Source: https://ssl.sh/tools/tls-config-generator/apache/
Last updated: 2026-11-10

Generate mod_ssl settings for Apache httpd with TLS 1.2/1.3, HSTS and a redirect, plus the modules and versions they need.

The Apache preset of the [TLS config generator](https://ssl.sh/tools/tls-config-generator/) writes mod_ssl settings for Apache httpd. Pick the profile and options, copy the output into your site configuration (for example `/etc/apache2/sites-available/example.com-ssl.conf` or `/etc/httpd/conf.d/ssl.conf`), test with `apachectl configtest` and reload.

## Example: intermediate profile

```apache
<VirtualHost *:80>
    ServerName example.com
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile      /etc/ssl/example.com/fullchain.pem
    SSLCertificateKeyFile   /etc/ssl/example.com/privkey.pem
    Protocols h2 http/1.1
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
</VirtualHost>

# global settings (outside <VirtualHost>)
SSLProtocol             -all +TLSv1.2 +TLSv1.3
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLOpenSSLConfCmd       Curves X25519:prime256v1:secp384r1
SSLHonorCipherOrder     off
SSLSessionTickets       off
```

## Version requirements

- **Apache 2.4.37+ with OpenSSL 1.1.1+** for TLS 1.3 (`apachectl -V` and `openssl version`).
- **Apache 2.4.8+** to put the chain in `SSLCertificateFile`. Older versions need `SSLCertificateChainFile chain.pem`.
- **mod_http2** for the `Protocols h2 http/1.1` line; drop the line if the module is not available.
- **X25519MLKEM768**: replace the Curves line with `SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1:secp384r1` when httpd links OpenSSL 3.5+.

## Test and reload

```bash
sudo apachectl configtest && sudo systemctl reload apache2   # httpd on RHEL, Rocky, AlmaLinux
```

## Common mistakes

- **Duplicate SSLProtocol lines**: distribution files such as `ssl.conf` or `options-ssl-apache.conf` (written by certbot) may set their own values. The last one read wins; search with `grep -ri sslprotocol /etc/apache2 /etc/httpd`.
- **Header not sent**: `mod_headers` is not enabled, or the header is in the port-80 VirtualHost only.
- **Old chain file**: after renewal `SSLCertificateChainFile` still points to an outdated intermediate. Use the full chain in `SSLCertificateFile`.


## FAQ

**Which modules do I need?**

mod_ssl for TLS, mod_headers for the HSTS header, mod_rewrite for the redirect and mod_http2 for HTTP/2. On Debian and Ubuntu enable them with a2enmod ssl headers rewrite http2.

**Where does each directive go?**

Certificate files, ServerName and the HSTS header belong in the <VirtualHost *:443> block. SSLProtocol, SSLCipherSuite, SSLHonorCipherOrder and SSLSessionTickets can be global (outside any VirtualHost) so all sites share them. SSLStaplingCache must be global.

**Apache says 'Invalid command SSLOpenSSLConfCmd'. Why?**

That directive exists only when mod_ssl is built against OpenSSL 1.0.2 or newer; some builds against LibreSSL or old OpenSSL lack it. Remove the line, or upgrade.