Cfrtjryk

# cat /etc/letsencrypt/options-ssl-apache.conf



# Baseline setting to Include for SSL sites using Let's Encrypt certificates



SSLEngine on



# Intermediate configuration, tweak to your needs

SSLProtocol             -all +TLSv1.1 +TLSv1.2

#SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

SSLHonorCipherOrder     on

SSLCompression          off



SSLOptions +StrictRequire



# Add vhost name to log entries

LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i"" vhost_combined

LogFormat "%v %h %l %u %t "%r" %>s %b" vhost_common



CustomLog /var/log/apache2/access.log vhost_combined

LogLevel warn

ErrorLog /var/log/apache2/error.log



# Always ensure Cookies have "Secure" set (JAH 2012/1)

Header edit Set-Cookie (?i)^(.*)(;s*secure)??((s*;)?(.*)) "$1; Secure$3$4"

As I have my own global SSL settings set directly in Apache, I don't want the Certbot not to include the mentioned file with the line:

Include /etc/letsencrypt/options-ssl-apache.conf

The line gets duplicated by the way, I have found it 3 times in the VirtualHosts... I want the Certbot not to include this file at all.

How am I supposed to do this?

You will want to use the certonly command:

Authenticators are plugins used with the certonly command to obtain a
certificate. The authenticator validates that you control the
domain(s) you are requesting a certificate for, obtains a certificate
for the specified domain(s), and places the certificate in the
/etc/letsencrypt directory on your machine. The authenticator does not
install the certificate (it does not edit any of your server’s
configuration files to serve the obtained certificate)...

usage:

certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

    ...

obtain, install, and renew certificates:

    (default) run   Obtain & install a certificate in your current webserver

    certonly        Obtain or renew a certificate, but do not install it

Examples:

certbot certonly --webroot -w /var/www/example -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net



certbot certonly --standalone -d www.example.com -d example.com