+# High security: no weak ciphers, at least 256 bit
+# (except TLS_AES_128_GCM_SHA256 which is required by TLSv1.3)
+#SSLCipherSuite HIGH:!aNULL:!AES128:!ARIA128:!CAMELLIA128:!RSA:!SHA:!SHA256:!SHA384
+
+# If you don't care about TLSv1.3 requirements and don't want any 128 bit
+# cipher you can disable TLS_AES_128_GCM_SHA256 by uncommenting line below
+#SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384
+
+# Strong security: no weak ciphers, at least 128 bit
+# Recommended setting if you are not paranoid
+SSLCipherSuite HIGH:!aNULL:!RSA:!SHA:!SHA256:!SHA384
+
+# Medium security: includes some weak ciphers, at least 256 bit
+# (except TLS_AES_128_GCM_SHA256 which is required by TLSv1.3)
+#SSLCipherSuite HIGH:!aNULL:!AES128:!ARIA128:!CAMELLIA128:!RSA
+
+# Low security: includes some weak ciphers, at least 128 bit
+#SSLCipherSuite HIGH:!aNULL:!RSA
+
+SSLHonorCipherOrder on
+SSLCompression off
+SSLSessionTickets off
+
+# Use this command to generate 4096 DH parameters (it will take long time):
+# openssl dhparam -out /etc/httpd/ssl/dhparams.pem 4096
+# When finished, uncomment line below
+#SSLOpenSSLConfCmd DHParameters /etc/httpd/ssl/dhparams.pem
+
+SSLOpenSSLConfCmd ECDHParameters secp384r1
+SSLOpenSSLConfCmd Curves secp521r1:secp384r1
+
+Header always set Strict-Transport-Security max-age=31556952;includeSubDomains
+Header always set X-Frame-Options SAMEORIGIN
+Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
+Header always set X-Content-Type-Options nosnif
+
+# OCSP Stapling
+SSLUseStapling on
+SSLStaplingResponderTimeout 5
+SSLStaplingReturnResponderErrors off
+SSLStaplingCache shmcb:/var/cache/httpd/ocsp(128000)
+
+# Whether to allow non-SNI clients to access a name-based virtual host.
+#SSLStrictSNIVHostCheck on