hq.site.ru.conf

<VirtualHost *:80>
    ServerName hq.site.ru
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
	ServerName hq.site.ru
	ServerAdmin webmaster@localhost
	DocumentRoot /var/www/hq.site.ru
	ErrorLog ${APACHE_LOG_DIR}/hq.site.ru.ru.error.log
	CustomLog ${APACHE_LOG_DIR}/hq.site.ru.ru.access.log combined

	SSLEngine on
	SSLCertificateFile /etc/letsencrypt/live/hq.site.ru/cert.pem
	SSLCertificateChainFile /etc/letsencrypt/live/hq.site.ru/fullchain.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/hq.site.ru/privkey.pem
	SSLCACertificateFile /etc/letsencrypt/live/hq.site.ru/chain.pem

	# enable HTTP/2, if available
	Protocols h2 http/1.1

	# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
#	Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>

# intermediate configuration
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder     off
SSLSessionTickets       off

SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"