Também não consegui encontrar, por isso consultei a fonte ( e outro documento ) que declara:
security: Security parameters & server settings --rsa-key-size N Size of the RSA key. (default: 2048) --must-staple Adds the OCSP Must Staple extension to the certificate. Autoconfigures OCSP Stapling for supported setups (Apache version >= 2.3.3 ). (default: False) --redirect Automatically redirect all HTTP traffic to HTTPS for the newly authenticated vhost. (default: Ask) --no-redirect Do not automatically redirect all HTTP traffic to HTTPS for the newly authenticated vhost. (default: Ask) --hsts Add the Strict-Transport-Security header to every HTTP response. Forcing browser to always use SSL for the domain. Defends against SSL Stripping. (default: None) --uir Add the "Content-Security-Policy: upgrade-insecure- requests" header to every HTTP response. Forcing the browser to use https:// for every http:// resource. (default: None) --staple-ocsp Enables OCSP Stapling. A valid OCSP response is stapled to the certificate that the server offers during TLS. (default: None) --strict-permissions Require that all configuration files are owned by the current user; only needed if your config is somewhere unsafe like /tmp/ (default: False)
e tentei no meu ambiente de testes:
certbot --authenticator webroot --installer apache
[...]
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):2
Enabled Apache rewrite module
Redirecting vhost in /etc/apache2/sites-enabled/example.conf to ssl vhost in /etc/apache2/sites-enabled/example.ssl.conf
-------------------------------------------------------------------------------
Congratulations! You have successfully enabled https://example.com and https://www.example.com
You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=example.com
certbot enhance --hsts
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator None, Installer apache
Which certificate would you like to use to enhance your configuration?
-------------------------------------------------------------------------------
1: example.com
-------------------------------------------------------------------------------
Press 1 [enter] to confirm the selection (press 'c' to cancel):
Which domain names would you like to enable the selected enhancements for?
-------------------------------------------------------------------------------
1: example.com
2: www.example.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Adding Strict-Transport-Security header to ssl vhost in /etc/apache2/sites-enabled/example.ssl.conf
certbot enhance --uir
Plugins selected: Authenticator None, Installer apache
Which certificate would you like to use to enhance your configuration?
-------------------------------------------------------------------------------
1: example.com
-------------------------------------------------------------------------------
Press 1 [enter] to confirm the selection (press 'c' to cancel):
Which domain names would you like to enable the selected enhancements for?
-------------------------------------------------------------------------------
1: example.com
2: www.example.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Adding Upgrade-Insecure-Requests header to ssl vhost in /etc/apache2/sites-enabled/example.ssl.conf
Você pode adivinhar o resto das opções (não tente todas elas).
Adicionou as seguintes linhas ao meu ssl.conf habilitado para sites:
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
Header always set Strict-Transport-Security "max-age=31536000"
Header always set Content-Security-Policy upgrade-insecure-requests
e estes nos meus sites não-ssl.conf:
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.example.com [OR]
RewriteCond %{SERVER_NAME} =example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]