# Baseline setting to Include for SSL sites

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol		+TLSv1.2 -TLSv1.1 -TLSv1 -SSLv3 -SSLv2
SSLProxyProtocol	+TLSv1.2 -TLSv1.1 -TLSv1 -SSLv3 -SSLv2
SSLCipherSuite		EECDH+AES:+AES256:+AES128:-SHA
SSLHonorCipherOrder	on
SSLCompression		off

#SSLOpenSSLConfCmd	DHParameters /etc/ssl/private/dh4096.pem

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

#CustomLog /var/log/apache2/access.log vhost_combined
#LogLevel warn
#ErrorLog /var/log/apache2/error.log

# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"
