We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Apache SSL cipher settings are old, no ChaCha20
The Nginx plugin's `options-ssl-nginx.conf` file uses Mozilla's current intermediate SSL cipher configuration.

The Apache plugin probably did too... except it hasn't been updated since 2014: 2faacc1b43786edd5386305f9cffec376b5a5d26

Should Certbot's Apache settings be updated?

The main difference is that the new configuration adds ChaCha20 cipher suites. (It also removes a few things.)

Should this wait until after further documentation/feature improvements in #4830?

If so, how about a stopgap patch to add ChaCha20 without removing anything?

Differences with OpenSSL 1.0.2 or 1.1.0:

* Adds ChaCha20. (Yay!)
* Adds newer 3DES cipher suites with key exchange/signature algorithms other than RSA/RSA. (Probably doesn't matter. Anything that supports ECDHE-ECDSA ought to support a better cipher than 3DES. ) (Edit: Mozilla suggests that EDH-RSA 3DES is useful, though,.)
* Removes AES-CCM. (OpenSSL 1.1. Probably only included inadvertently.)
* Removes Camellia. (Perfectly nice cipher, but everybody uses AES.)
* Removes some static DH and SRP key exchange cipher suites. (Probably only included by accident, mostly or entirely ignored by servers and clients.)
* Changes the order of some things.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `certbot-apache/certbot_apache/constants.py`
Content:
```
1 """Apache plugin constants."""
2 import pkg_resources
3 
4 
5 MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
6 """Name of the mod_ssl config file as saved in `IConfig.config_dir`."""
7 
8 
9 UPDATED_MOD_SSL_CONF_DIGEST = ".updated-options-ssl-apache-conf-digest.txt"
10 """Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`."""
11 
12 ALL_SSL_OPTIONS_HASHES = [
13     '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',
14     '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',
15     '5a922826719981c0a234b1fbcd495f3213e49d2519e845ea0748ba513044b65b',
16     '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',
17     'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',
18     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',
19 ]
20 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""
21 
22 AUGEAS_LENS_DIR = pkg_resources.resource_filename(
23     "certbot_apache", "augeas_lens")
24 """Path to the Augeas lens directory"""
25 
26 REWRITE_HTTPS_ARGS = [
27     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,NE,R=permanent]"]
28 """Apache version<2.3.9 rewrite rule arguments used for redirections to
29 https vhost"""
30 
31 REWRITE_HTTPS_ARGS_WITH_END = [
32     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,NE,R=permanent]"]
33 """Apache version >= 2.3.9 rewrite rule arguments used for redirections to
34     https vhost"""
35 
36 OLD_REWRITE_HTTPS_ARGS = [
37     ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,QSA,R=permanent]"],
38     ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"]]
39 
40 HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
41              "\"max-age=31536000\""]
42 """Apache header arguments for HSTS"""
43 
44 UIR_ARGS = ["always", "set", "Content-Security-Policy",
45             "upgrade-insecure-requests"]
46 
47 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
48                "Upgrade-Insecure-Requests": UIR_ARGS}
49
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/certbot-apache/certbot_apache/constants.py b/certbot-apache/certbot_apache/constants.py
--- a/certbot-apache/certbot_apache/constants.py
+++ b/certbot-apache/certbot_apache/constants.py
@@ -16,6 +16,8 @@
     '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',
     'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',
     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',
+    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',
+    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',
 ]
 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""

{"golden_diff": "diff --git a/certbot-apache/certbot_apache/constants.py b/certbot-apache/certbot_apache/constants.py\n--- a/certbot-apache/certbot_apache/constants.py\n+++ b/certbot-apache/certbot_apache/constants.py\n@@ -16,6 +16,8 @@\n     '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',\n     'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',\n     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',\n+    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',\n+    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',\n ]\n \"\"\"SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC\"\"\"\n", "issue": "Apache SSL cipher settings are old, no ChaCha20\nThe Nginx plugin's `options-ssl-nginx.conf` file uses Mozilla's current intermediate SSL cipher configuration.\r\n\r\nThe Apache plugin probably did too... except it hasn't been updated since 2014: 2faacc1b43786edd5386305f9cffec376b5a5d26\r\n\r\nShould Certbot's Apache settings be updated?\r\n\r\nThe main difference is that the new configuration adds ChaCha20 cipher suites. (It also removes a few things.)\r\n\r\nShould this wait until after further documentation/feature improvements in #4830?\r\n\r\nIf so, how about a stopgap patch to add ChaCha20 without removing anything?\r\n\r\nDifferences with OpenSSL 1.0.2 or 1.1.0:\r\n\r\n* Adds ChaCha20. (Yay!)\r\n* Adds newer 3DES cipher suites with key exchange/signature algorithms other than RSA/RSA. (Probably doesn't matter. Anything that supports ECDHE-ECDSA ought to support a better cipher than 3DES. ) (Edit: Mozilla suggests that EDH-RSA 3DES is useful, though,.)\r\n* Removes AES-CCM. (OpenSSL 1.1. Probably only included inadvertently.)\r\n* Removes Camellia. (Perfectly nice cipher, but everybody uses AES.)\r\n* Removes some static DH and SRP key exchange cipher suites. (Probably only included by accident, mostly or entirely ignored by servers and clients.)\r\n* Changes the order of some things.\n", "before_files": [{"content": "\"\"\"Apache plugin constants.\"\"\"\nimport pkg_resources\n\n\nMOD_SSL_CONF_DEST = \"options-ssl-apache.conf\"\n\"\"\"Name of the mod_ssl config file as saved in `IConfig.config_dir`.\"\"\"\n\n\nUPDATED_MOD_SSL_CONF_DIGEST = \".updated-options-ssl-apache-conf-digest.txt\"\n\"\"\"Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`.\"\"\"\n\nALL_SSL_OPTIONS_HASHES = [\n    '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',\n    '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',\n    '5a922826719981c0a234b1fbcd495f3213e49d2519e845ea0748ba513044b65b',\n    '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',\n    'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',\n    'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',\n]\n\"\"\"SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC\"\"\"\n\nAUGEAS_LENS_DIR = pkg_resources.resource_filename(\n    \"certbot_apache\", \"augeas_lens\")\n\"\"\"Path to the Augeas lens directory\"\"\"\n\nREWRITE_HTTPS_ARGS = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,NE,R=permanent]\"]\n\"\"\"Apache version<2.3.9 rewrite rule arguments used for redirections to\nhttps vhost\"\"\"\n\nREWRITE_HTTPS_ARGS_WITH_END = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,NE,R=permanent]\"]\n\"\"\"Apache version >= 2.3.9 rewrite rule arguments used for redirections to\n    https vhost\"\"\"\n\nOLD_REWRITE_HTTPS_ARGS = [\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,QSA,R=permanent]\"],\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,QSA,R=permanent]\"]]\n\nHSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n             \"\\\"max-age=31536000\\\"\"]\n\"\"\"Apache header arguments for HSTS\"\"\"\n\nUIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n            \"upgrade-insecure-requests\"]\n\nHEADER_ARGS = {\"Strict-Transport-Security\": HSTS_ARGS,\n               \"Upgrade-Insecure-Requests\": UIR_ARGS}\n", "path": "certbot-apache/certbot_apache/constants.py"}], "after_files": [{"content": "\"\"\"Apache plugin constants.\"\"\"\nimport pkg_resources\n\n\nMOD_SSL_CONF_DEST = \"options-ssl-apache.conf\"\n\"\"\"Name of the mod_ssl config file as saved in `IConfig.config_dir`.\"\"\"\n\n\nUPDATED_MOD_SSL_CONF_DIGEST = \".updated-options-ssl-apache-conf-digest.txt\"\n\"\"\"Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`.\"\"\"\n\nALL_SSL_OPTIONS_HASHES = [\n    '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',\n    '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',\n    '5a922826719981c0a234b1fbcd495f3213e49d2519e845ea0748ba513044b65b',\n    '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',\n    'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',\n    'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',\n    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',\n    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',\n]\n\"\"\"SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC\"\"\"\n\nAUGEAS_LENS_DIR = pkg_resources.resource_filename(\n    \"certbot_apache\", \"augeas_lens\")\n\"\"\"Path to the Augeas lens directory\"\"\"\n\nREWRITE_HTTPS_ARGS = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,NE,R=permanent]\"]\n\"\"\"Apache version<2.3.9 rewrite rule arguments used for redirections to\nhttps vhost\"\"\"\n\nREWRITE_HTTPS_ARGS_WITH_END = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,NE,R=permanent]\"]\n\"\"\"Apache version >= 2.3.9 rewrite rule arguments used for redirections to\n    https vhost\"\"\"\n\nOLD_REWRITE_HTTPS_ARGS = [\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,QSA,R=permanent]\"],\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,QSA,R=permanent]\"]]\n\nHSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n             \"\\\"max-age=31536000\\\"\"]\n\"\"\"Apache header arguments for HSTS\"\"\"\n\nUIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n            \"upgrade-insecure-requests\"]\n\nHEADER_ARGS = {\"Strict-Transport-Security\": HSTS_ARGS,\n               \"Upgrade-Insecure-Requests\": UIR_ARGS}\n", "path": "certbot-apache/certbot_apache/constants.py"}]}