SSLEngine on

# Container uses a unique non-signed certificate
# RequestHeader unset Accept-Encoding

SSLProtocol all +TLSv1.2 +TLSv1.3
# -SSLv2 SSLv3 +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder             on

# Encoded slashes need to be allowed
# AllowEncodedSlashes NoDecode


# SSL configuration, you may want to take the easy route instead and use Lets Encrypt!
# keep the host
ProxyPreserveHost On
SSLProxyEngine     On
SSLProxyVerify None
SSLProxyCheckPeerCN On
SSLProxyCheckPeerName On

SSLCertificateFile /etc/letsencrypt/live/logicmoo.org-0006/fullchain.pem   
SSLCertificateKeyFile /etc/letsencrypt/live/logicmoo.org-0006/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf

Include /etc/apache2/conf-available/doc_root.conf