<IfModule mod_ssl.c>
	<VirtualHost *:443>
		ServerName lists.domaine.eu
		ServerAdmin postmaster@domaine.eu
		DocumentRoot /var/www/lists

		ScriptAlias /mailman/ /usr/lib/cgi-bin/mailman/
		<Directory /usr/lib/cgi-bin/mailman/>
	        	AllowOverride None
			Options +ExecCGI
			AddHandler cgi-script .cgi index.cgi
			Require all granted
		</Directory>

		Alias /images/mailman/ /usr/share/images/mailman/
		<Directory /usr/share/images/mailman/>
		        AllowOverride None
			Require all granted
		</Directory>

		Alias /pipermail/ /var/lib/mailman/archives/public/
		<Directory /var/lib/mailman/archives/public/>
        		Options Indexes MultiViews FollowSymLinks
			AllowOverride None
			Require all granted
		</Directory>

		<Directory /var/lib/mailman/archives/>
			Options FollowSymLinks
			AllowOverride None
			Require all granted
		</Directory>

		ScriptAlias /admin /usr/lib/cgi-bin/mailman/admin
		ScriptAlias /admindb /usr/lib/cgi-bin/mailman/admindb
		ScriptAlias /confirm /usr/lib/cgi-bin/mailman/confirm
		ScriptAlias /create /usr/lib/cgi-bin/mailman/create
		ScriptAlias /edithtml /usr/lib/cgi-bin/mailman/edithtml
		ScriptAlias /listinfo /usr/lib/cgi-bin/mailman/listinfo
		ScriptAlias /options /usr/lib/cgi-bin/mailman/options
		ScriptAlias /private /usr/lib/cgi-bin/mailman/private
		ScriptAlias /rmlist /usr/lib/cgi-bin/mailman/rmlist
		ScriptAlias /roster /usr/lib/cgi-bin/mailman/roster
		ScriptAlias /subscribe /usr/lib/cgi-bin/mailman/subscribe

		<IfModule mod_rewrite.c>
			RewriteEngine on
			# Redirect root access to mailman list
			RewriteRule     ^$      /mailman/listinfo       [R=permanent,L]
			RewriteRule     ^/$     /mailman/listinfo       [R=permanent,L]
			RewriteRule     ^/favicon.ico   - [L]
			RewriteRule     ^/robots.txt    - [L]
		</IfModule>

		ErrorLog ${APACHE_LOG_DIR}/error.log
		CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

                # SSL Engine Switch:
                # Enable/Disable SSL for this virtual host.
                SSLEngine on
                # The CRIME attack uses SSL Compression, we need to disable that
                SSLCompression off
                SSLProtocol +TLSv1.2 -TLSv1.1 -TLSv1 -SSLv3 -SSLv2
                SSLHonorCipherOrder On
                SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
                SSLCertificateFile      /etc/apache2/ssl/certs/lists_domaine.crt
                SSLCertificateKeyFile   /etc/apache2/ssl/domaine.key
                Header always add Strict-Transport-Security "max-age=15768000; preload"
                #   SSL Engine Options:
                #   Set various options for the SSL engine.
                #   o FakeBasicAuth:
                #        Translate the client X.509 into a Basic Authorisation.  This means that
                #        the standard Auth/DBMAuth methods can be used for access control.  The
                #        user name is the `one line' version of the client's X.509 certificate.
                #        Note that no password is obtained from the user. Every entry in the user
                #        file needs this password: `xxj31ZMTZzkVA'.
                #   o ExportCertData:
                #        This exports two additional environment variables: SSL_CLIENT_CERT and
                #        SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
                #        server (always existing) and the client (only existing when client
                #        authentication is used). This can be used to import the certificates
                #        into CGI scripts.
                #   o StdEnvVars:
                #        This exports the standard SSL/TLS related `SSL_*' environment variables.
                #        Per default this exportation is switched off for performance reasons,
                #        because the extraction step is an expensive operation and is usually
                #        useless for serving static content. So one usually enables the
                #        exportation for CGI and SSI requests only.
                #   o OptRenegotiate:
                #        This enables optimized SSL connection renegotiation handling when SSL
                #        directives are used in per-directory context.
                #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>
                #   SSL Protocol Adjustments:
                #   The safe and default but still SSL/TLS standard compliant shutdown
                #   approach is that mod_ssl sends the close notify alert but doesn't wait for
                #   the close notify alert from client. When you need a different shutdown
                #   approach you can use one of the following variables:
                #   o ssl-unclean-shutdown:
                #        This forces an unclean shutdown when the connection is closed, i.e. no
                #        SSL close notify alert is send or allowed to received.  This violates
                #        the SSL/TLS standard but is needed for some brain-dead browsers. Use
                #        this when you receive I/O errors because of the standard approach where
                #        mod_ssl sends the close notify alert.
                #   o ssl-accurate-shutdown:
                #        This forces an accurate shutdown when the connection is closed, i.e. a
                #        SSL close notify alert is send and mod_ssl waits for the close notify
                #        alert of the client. This is 100% SSL/TLS standard compliant, but in
                #        practice often causes hanging connections with brain-dead browsers. Use
                #        this only for browsers where you know that their SSL implementation
                #        works correctly.
                #   Notice: Most problems of broken clients are also related to the HTTP
                #   keep-alive facility, so you usually additionally want to disable
                #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
                #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
                #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
                #   "force-response-1.0" for this.
                BrowserMatch "MSIE [2-6]" \
                                nokeepalive ssl-unclean-shutdown \
                                downgrade-1.0 force-response-1.0
                # MSIE 7 and newer should be able to use keepalive
                BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

	</VirtualHost>
</IfModule>