LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so

Listen 8443

SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512

AddType application/x-x509-ca-cert .crt

SSLSessionCache     shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout  300

<VirtualHost *:8443>
    # Enable/Disable SSL for this virtual host.
    SSLEngine on

    # intermediate configuration
    SSLProtocol             -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder     off
    SSLSessionTickets       off

    SSLCertificateFile /etc/ssl/apache2/ssl.crt
    SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
    # SSLCACertificatePath /etc/ssl/apache2/chain/

    # enable HTTP/2, if available
    Protocols h2 http/1.1

    # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
    Header always set Strict-Transport-Security "max-age=63072000"

    <LocationMatch "/(ping|status)">
        Require all granted

        SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
    </LocationMatch>

    <Directory "/usr/share/zabbix">
        Options FollowSymLinks
        AllowOverride None
        Require all granted

        <FilesMatch \.php$>
            SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
        </FilesMatch>

        <filesMatch "\.(ico)$">
            ExpiresActive On
            ExpiresDefault "access plus 1 year"
            Header append Cache-Control "public"
        </filesMatch>

        <filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
            ExpiresActive On
            ExpiresDefault "access plus 14 day"
            Header append Cache-Control "public"
        </filesMatch>
    </Directory>

    <Directory "/usr/share/zabbix/conf">
        Require all denied
        <files *.php>
            Require all denied
        </files>
    </Directory>

    <Directory "/usr/share/zabbix/app">
        Require all denied
        <files *.php>
            Require all denied
        </files>
    </Directory>

    <Directory "/usr/share/zabbix/include">
        Require all denied
        <files *.php>
            Require all denied
        </files>
    </Directory>

    <Directory "/usr/share/zabbix/local">
        Require all denied
        <files *.php>
            Require all denied
        </files>
    </Directory>

    <Directory "/usr/share/zabbix/locale">
        Require all denied
        <files *.php>
            Require all denied
        </files>
    </Directory>

    <Directory "/usr/share/zabbix/vendor">
        Require all denied
        <files *.php>
            Require all denied
        </files>
    </Directory>
</VirtualHost>