Listen 443
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/run/httpd/sslcache(1024000)"
SSLSessionCacheTimeout 3600
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
SSLStrictSNIVHostCheck off

SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLOpenSSLConfCmd Curves X25519MLKEM768:X25519:prime256v1:secp384r1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLCipherSuite TLSv1.3 TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

SSLHonorCipherOrder off
SSLSessionTickets off
SSLCompression off

SSLUseStapling on
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/run/httpd/stapling_cache(128000)

<VirtualHost *:443>

    ServerName www.example.com
    DocumentRoot "/usr/local/apache2/htdocs"

    <Directory "/usr/local/apache2/htdocs">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
	
    Protocols h2 http/1.1

    SetOutputFilter BROTLI_COMPRESS;DEFLATE
    SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip no-brotli dont-vary

    SSLEngine on
    Header always set Strict-Transport-Security "max-age=31536000"
    SSLCertificateFile /etc/pki/tls/certs/server.crt
    SSLCertificateKeyFile /etc/pki/tls/private/server.key

    ErrorLog "logs/error_log"
    CustomLog "logs/access_log" combined
</VirtualHost>