SSLCipherSuite EECDH+AESGCM:EDH+AESGCM
#
# Requires Apache 2.4.36 & OpenSSL 1.1.1
#
SSLProtocol -all +TLSv1.3 +TLSv1.2
SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1
#
# Older versions
# SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
#
SSLHonorCipherOrder On
#
# Disable preloading HSTS for now.  You can use the commented out header line that includes 
# the "preload" directive if you understand the implications.
# Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
#
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
#
# Requires Apache >= 2.4
#
SSLCompression off
SSLUseStapling off
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
#
# Requires Apache >= 2.4.11
#
SSLSessionTickets Off