CentOS 7 - Apache

Apache 2.4 with PHP-FPM

# yum -y install httpd httpd-tools mod_ssl
# vim /etc/httpd/conf.modules.d/00-mpm.conf
...
#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
...
LoadModule mpm_event_module modules/mod_mpm_event.so

# vim /etc/httpd/conf.d/php.conf
...
#<FilesMatch \.php$>
#    SetHandler application/x-httpd-php
#</FilesMatch>

#Proxy declaration
<Proxy "unix:/var/run/php-fpm/default.sock|fcgi://php-fpm">
    #we must declare a parameter in here (doesn't matter which) or it'll not register the proxy ahead of time
    ProxySet disablereuse=off
</Proxy>
# Redirect to the proxy
<FilesMatch \.php$>
    SetHandler proxy:fcgi://php-fpm
</FilesMatch>

# mkdir /etc/httpd/sites-available
# mkdir /etc/httpd/sites-enabled
# vim /etc/httpd/conf/httpd.conf
...
# at the end add
IncludeOptional sites-enabled/*.conf

# vim /etc/httpd/sites-available/example.com.conf
<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot "/home/example/prod/html"
    ErrorLog /var/log/httpd/example.com-error.log
    CustomLog /var/log/httpd/example.com-access.log combined
    <Directory "/home/example/prod/html/">
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Order allow,deny
        #Allow from all
        Allow from <my_ip_address>
        Require all granted
    </Directory>
</VirtualHost>

# ln -s /etc/httpd/sites-available/example.com.conf /etc/httpd/sites-enabled/example.com.conf
# vim /etc/group
...add apache group to example user...
# chmod 755 /home/example
# systemctl start httpd
# systemctl status httpd
# systemctl enable httpd

HTTPS (SSL)

Obtain SSL certificate from Let's Encrypt (using getssl bash tool: https://github.com/srvrco/getssl):

# cd
# curl --silent https://raw.githubusercontent.com/srvrco/getssl/master/getssl > getssl ; chmod 700 getssl
# ./getssl -c example.com
# vim ~/.getssl/example.com/getssl.cfg
CA="https://acme-staging.api.letsencrypt.org"
ACL=('/<full_path_to_web_root>/.well-known/acme-challenge')
USE_SINGLE_ACL="true"
DOMAIN_CERT_LOCATION="/etc/pki/tls/certs/example.com.crt"
DOMAIN_CHAIN_LOCATION="/etc/pki/tls/certs/example.com.chained.crt"
DOMAIN_KEY_LOCATION="/etc/pki/tls/private/example.com.key"
RELOAD_CMD="systemctl reload httpd"

# ./getssl example.com

# vim ~/.getssl/example.com/getssl.cfg
CA="https://acme-v01.api.letsencrypt.org"

# ./getssl example.com

# crontab -e
1 1 * * * /root/getssl -a -q

Apache config:

# yum -y install mod_ssl
# vim /etc/httpd/sites-available/example.conf

...
<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot "/home/example/prod/html"

    SSLEngine on
    SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
    SSLCertificateFile /etc/pki/tls/certs/example.com.crt
    SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
    SSLCertificateChainFile /etc/pki/tls/certs/example.com.chained.crt

    ErrorLog /var/log/httpd/example.com-error.log
    CustomLog /var/log/httpd/example.com-access.log combined
    <Directory "/home/example/prod/html/">
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
        #Allow from ip_address
        Require all granted
    </Directory>
</VirtualHost>

Test website/server on https://www.ssllabs.com/ssltest/index.html (should be A rating) or https://ssldecoder.org/