# Do I need: Include /etc/letsencrypt/options-ssl-apache.conf in my apache.conf file **URL:** \ **Category:** Issuance Tech\ **Created:** [April 10, 2020, 2:47am UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990 "2020-04-10T02:47:08Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![castletonroad](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@castletonroad](https://community.letsencrypt.org/u/castletonroad)\ **Post date:** [April 10, 2020, 2:47am UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990/1 "2020-04-10T02:47:08Z")
Hi, I see I have the following line in my apache vhosts file: Include /etc/letsencrypt/options-ssl-apache.conf Do I need this to successfully renew my certificates? My vhost file is strict on TLS: _SSLProtocol -all +TLSv1.2 +TLSv1.3_ _SSLHonorCipherOrder on_ _SSLCipherSuite EECDH+AESGCM:EDH+AESGCM_ But the Include has much lower level of TLS: _SSLProtocol all -SSLv2 -SSLv3_ _SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES25_ _6-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:EC_ _DHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-_ _DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS_ _SSLHonorCipherOrder on_ _SSLCompression off_ Clearly I don’t want to lower my encryption requirements. Can I # the Include line and still safely renew my certs? Thanks. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 10, 2020, 2:52am UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990/2 "2020-04-10T02:52:56Z")
> [@castletonroad](#): > > /etc/letsencrypt/options-ssl-apache.conf You can do without it. But you may need to include similar statements elsewhere. Primarily: `SSLEngine on` ---
**Author:** ![castletonroad](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@castletonroad](https://community.letsencrypt.org/u/castletonroad)\ **Post date:** [April 10, 2020, 3:14am UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990/3 "2020-04-10T03:14:24Z")
Thank you. Yes, the full SSL entries are: SSLEngine on \ SSLOptions +StdEnvVars \ SSLOptions +StdEnvVars SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLHonorCipherOrder on SSLCipherSuite EECDH+AESGCM:EDH+AESGCM SSLCompression off ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [April 10, 2020, 3:25am UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990/4 "2020-04-10T03:25:48Z")
Hi @castletonroad, The purpose of continuing to include this is so that the Certbot team can keep you up-to-date with defaults recommended by experts in the future. If you’ve made your own deliberate configuration changes and want to be responsible for maintaining your TLS options, you can feel free not to include the file (or to change its contents). Certificate renewals should work just fine without it. ---
**Author:** ![castletonroad](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@castletonroad](https://community.letsencrypt.org/u/castletonroad)\ **Post date:** [April 10, 2020, 10:42pm UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990/5 "2020-04-10T22:42:36Z")
@shoen I don’t need to cater for lower encryption levels (and backward compatibility) on my site, so would like to exclude this file. Thanks very much for confirming that this is OK. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 10, 2020, 10:42pm UTC](https://community.letsencrypt.org/t/do-i-need-include-etc-letsencrypt-options-ssl-apache-conf-in-my-apache-conf-file/118990/6 "2020-05-10T22:42:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.