update-crypto-policies & Apache

Tuesday, 2 February 2021

System is Fedora 33 I'm attempting to enable Perfect Forwarding Secrecy 
(PFS) in Apache.

I started by setting the options I wanted in Apache only to find that 
the SSL options for Ciphers are ignored in the Apache configuration and 
instead are pulled from /etc/crypto-policies/back-ends directory.

I was able to disallow any TLS protocol below 1.2 in opensslcnf.config, 
but not sure what I need to enable PFS.

Suggestions would be appreciated.

Thanks Jeff