Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache shmcb:/run/httpd/sslcache(1024000)
SSLSessionCacheTimeout 3600
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
SSLStrictSNIVHostCheck off

SSLProtocol -all +TLSv1.2

SSLCipherSuite "ECDHE-ECDSA-AES128-GCM-SHA256 \
ECDHE-ECDSA-AES256-GCM-SHA384 \
ECDHE-ECDSA-AES128-SHA \
ECDHE-ECDSA-AES256-SHA \
ECDHE-ECDSA-AES128-SHA256 \
ECDHE-ECDSA-AES256-SHA384 \
ECDHE-RSA-AES128-GCM-SHA256 \
ECDHE-RSA-AES256-GCM-SHA384 \
ECDHE-RSA-AES128-SHA \
ECDHE-RSA-AES256-SHA \
ECDHE-RSA-AES128-SHA256 \
ECDHE-RSA-AES256-SHA384 \
DHE-RSA-AES128-GCM-SHA256 \
DHE-RSA-AES256-GCM-SHA384 \
DHE-RSA-AES128-SHA \
DHE-RSA-AES256-SHA \
DHE-RSA-AES128-SHA256 \
DHE-RSA-AES256-SHA256 \
EDH-RSA-DES-CBC3-SHA"

SSLHonorCipherOrder on
SSLCompression off

SSLUseStapling On
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/run/httpd/stapling_cache(128000)

<VirtualHost *:80>
    ServerName mattermost.example.com
    Redirect permanent / https://mattermost.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName mattermost.example.com
    ProxyPreserveHost On

    RewriteEngine On
    RewriteCond %{REQUEST_URI} /api/v[0-9]+/(users/)?websocket [NC,OR]
    RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
    RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
    RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]

    <Location />
        Require all granted
        ProxyPass http://127.0.0.1:8065/
        ProxyPassReverse http://127.0.0.1:8065/
        ProxyPassReverseCookieDomain 127.0.0.1 mattermost.example.com
    </Location>

    SSLEngine on
    Header always set Strict-Transport-Security "max-age=15768000"
    SSLCertificateFile /etc/pki/tls/certs/server.crt
    SSLCertificateKeyFile /etc/pki/tls/private/server.key
    # SSLCertificateChainFile /etc/pki/tls/certs/chain.crt

    SetEnvIf Request_URI "\.(gif|jpg|png|css|js)$" nolog
    ErrorLog logs/mattermost.example.com_error_log
    CustomLog logs/mattermost.example.com_access_log combined env=!nolog
</VirtualHost>