title: How do I enable perfect forward secrecy by default on Apache?
body: <p><strong><em>Warning:</strong> please only use the recommendations for Apache configuration from the answers below. For which cipher(s) to use - security norms change over time and some of the security advice below is already out of date.</em></p>
  
  <p>In the wake of recent events, I have been reconsidering my Apache setup. Currently, my apache site config looks something like this:</p>
  
  <pre><code> &lt;IfModule mod_ssl.c&gt;
      &lt;VirtualHost *:80&gt;
              ServerName example.com
              ServerAlias www.example.com
              Redirect permanent / https://example.com
      &lt;/VirtualHost&gt;
  
      &lt;VirtualHost *:443&gt;
              ServerAdmin webmaster@localhost
              ServerName example.com
  
              DocumentRoot /var/www-wordpress
              &lt;Directory /&gt;
                      Options FollowSymLinks
                      AllowOverride None
              &lt;/Directory&gt;
              &lt;Directory /var/www-wordpress&gt;
                      Options Indexes FollowSymLinks MultiViews
                      AllowOverride FileInfo
                      Order allow,deny
                      allow from all
              &lt;/Directory&gt;
  
              ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
              &lt;Directory "/usr/lib/cgi-bin"&gt;
                      AllowOverride None
                      Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                      Order allow,deny
                      Allow from all
              &lt;/Directory&gt;
  
              ErrorLog ${APACHE_LOG_DIR}/error.log
              LogLevel warn
  
              CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
              SSLCertificateFile    /etc/ssl/certs/example.com.crt
              SSLCertificateKeyFile /etc/ssl/private/example.com.key
              SSLCertificateChainFile /etc/ssl/certs/sub.class1.server.ca.pem
              &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
                      SSLOptions +StdEnvVars
              &lt;/FilesMatch&gt;
              &lt;Directory /usr/lib/cgi-bin&gt;
                      SSLOptions +StdEnvVars
              &lt;/Directory&gt;
  
              BrowserMatch "MSIE [2-6]" \
                      nokeepalive ssl-unclean-shutdown \
                      downgrade-1.0 force-response-1.0
              BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
      &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>What do I have to do to support perfect forward secrecy? How can I enable SSL perfect forward secrecy by default? How could I enforce it? </p>