apache-vhost.conf

LoadModule auth_digest_module libexec/apache24/mod_auth_digest.so
LoadModule deflate_module libexec/apache24/mod_deflate.so
LoadModule ssl_module libexec/apache24/mod_ssl.so
LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so
LoadModule proxy_module libexec/apache24/mod_proxy.so
LoadModule proxy_fcgi_module libexec/apache24/mod_proxy_fcgi.so

SetOutputFilter          DEFLATE
SetEnvIfNoCase           Request_URI "\.(?:gif|jpe?g|png)$" no-gzip

Listen                   443
SSLProtocol              All -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite           HIGH:!aNULL:!RSA:!AES128:!SSLv2:!SSLv3:!TLSv1
SSLHonorCipherOrder      on

SSLPassPhraseDialog      builtin
SSLSessionCache          "shmcb:/var/run/ssl_scache(512000)"
SSLSessionCacheTimeout   300

<VirtualHost *:80>
   ServerName            content.example.com:80
   RedirectPermanent     / https://content.example.com/
</VirtualHost>

<VirtualHost *:443>
   SetEnv CONTENT_TITLE  "CONTENT EXAMPLE"

   ServerName            content.example.com:443
   ServerAdmin           admin@example.com
   DocumentRoot          "/usr/local/www/ContentCGI/webdocs"

   <Directory "/usr/local/www/ContentCGI/webdocs">
      Require            all granted
   </Directory>

   <LocationMatch "^(/_|/.*/_).*$">
      ProxyPass          "unix:/tmp/ContentCGI.sock|fcgi://content.example.com"
      SSLOptions         +StdEnvVars
   </LocationMatch>

   <Location "/edit/">
      AuthType           Digest
      AuthDigestProvider file
      AuthUserFile       "etc/apache24/ContentEditors.passwd"
      AuthName           ContentEditors
      AuthDigestDomain   /
      Require            valid-user
      ProxyPass          "unix:/tmp/ContentCGI.sock|fcgi://content.example.com/edit/"
      SSLOptions         +StdEnvVars
   </Location>

   SSLEngine             on
   SSLCertificateFile    "etc/letsencrypt/live/example.com/fullchain.pem"
   SSLCertificateKeyFile "etc/letsencrypt/live/example.com/privkey.pem"
</VirtualHost>