apache2/conf-available/local-ssl.conf



<IfDefine !_TLSHOST>
    <IfDefine _HOST>
        Define _TLSHOST ${_HOST}
    </IfDefine>
</IfDefine>
<IfDefine !_TLS_KEY>
    <IfDefine _TLSHOST>
        Define _TLS_CERT_CHAIN /var/lib/dehydrated/certs/${_TLSHOST}/fullchain.pem
        Define _TLS_KEY /var/lib/dehydrated/certs/${_TLSHOST}/privkey.pem
    </IfDefine>
</IfDefine>

<If "%{HTTPS} == 'off'">
    RedirectMatch permanent ^(?!/.well-known/)(.*) https://${_HOST}/$1
</If>

SSLEngine on
<IfDefine _TLS_KEY>
    SSLCertificateFile ${_TLS_CERT_CHAIN}
    SSLCertificateKeyFile ${_TLS_KEY}
</IfDefine>

<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>