prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Apache SSL cipher settings are old, no ChaCha20
  The Nginx plugin's `options-ssl-nginx.conf` file uses Mozilla's current intermediate SSL cipher configuration.
  
  The Apache plugin probably did too... except it hasn't been updated since 2014: 2faacc1b43786edd5386305f9cffec376b5a5d26
  
  Should Certbot's Apache settings be updated?
  
  The main difference is that the new configuration adds ChaCha20 cipher suites. (It also removes a few things.)
  
  Should this wait until after further documentation/feature improvements in #4830?
  
  If so, how about a stopgap patch to add ChaCha20 without removing anything?
  
  Differences with OpenSSL 1.0.2 or 1.1.0:
  
  * Adds ChaCha20. (Yay!)
  * Adds newer 3DES cipher suites with key exchange/signature algorithms other than RSA/RSA. (Probably doesn't matter. Anything that supports ECDHE-ECDSA ought to support a better cipher than 3DES. ) (Edit: Mozilla suggests that EDH-RSA 3DES is useful, though,.)
  * Removes AES-CCM. (OpenSSL 1.1. Probably only included inadvertently.)
  * Removes Camellia. (Perfectly nice cipher, but everybody uses AES.)
  * Removes some static DH and SRP key exchange cipher suites. (Probably only included by accident, mostly or entirely ignored by servers and clients.)
  * Changes the order of some things.
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `certbot-apache/certbot_apache/constants.py`
  Content:
  ```
  1 """Apache plugin constants."""
  2 import pkg_resources
  3 
  4 
  5 MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
  6 """Name of the mod_ssl config file as saved in `IConfig.config_dir`."""
  7 
  8 
  9 UPDATED_MOD_SSL_CONF_DIGEST = ".updated-options-ssl-apache-conf-digest.txt"
  10 """Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`."""
  11 
  12 ALL_SSL_OPTIONS_HASHES = [
  13     '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',
  14     '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',
  15     '5a922826719981c0a234b1fbcd495f3213e49d2519e845ea0748ba513044b65b',
  16     '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',
  17     'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',
  18     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',
  19 ]
  20 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""
  21 
  22 AUGEAS_LENS_DIR = pkg_resources.resource_filename(
  23     "certbot_apache", "augeas_lens")
  24 """Path to the Augeas lens directory"""
  25 
  26 REWRITE_HTTPS_ARGS = [
  27     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,NE,R=permanent]"]
  28 """Apache version<2.3.9 rewrite rule arguments used for redirections to
  29 https vhost"""
  30 
  31 REWRITE_HTTPS_ARGS_WITH_END = [
  32     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,NE,R=permanent]"]
  33 """Apache version >= 2.3.9 rewrite rule arguments used for redirections to
  34     https vhost"""
  35 
  36 OLD_REWRITE_HTTPS_ARGS = [
  37     ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,QSA,R=permanent]"],
  38     ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"]]
  39 
  40 HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
  41              "\"max-age=31536000\""]
  42 """Apache header arguments for HSTS"""
  43 
  44 UIR_ARGS = ["always", "set", "Content-Security-Policy",
  45             "upgrade-insecure-requests"]
  46 
  47 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
  48                "Upgrade-Insecure-Requests": UIR_ARGS}
  49
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/certbot-apache/certbot_apache/constants.py b/certbot-apache/certbot_apache/constants.py
  --- a/certbot-apache/certbot_apache/constants.py
  +++ b/certbot-apache/certbot_apache/constants.py
  @@ -16,6 +16,8 @@
       '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',
       'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',
       'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',
  +    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',
  +    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',
   ]
   """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""
  
verification_info: {"golden_diff": "diff --git a/certbot-apache/certbot_apache/constants.py b/certbot-apache/certbot_apache/constants.py\n--- a/certbot-apache/certbot_apache/constants.py\n+++ b/certbot-apache/certbot_apache/constants.py\n@@ -16,6 +16,8 @@\n     '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',\n     'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',\n     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',\n+    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',\n+    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',\n ]\n \"\"\"SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC\"\"\"\n", "issue": "Apache SSL cipher settings are old, no ChaCha20\nThe Nginx plugin's `options-ssl-nginx.conf` file uses Mozilla's current intermediate SSL cipher configuration.\r\n\r\nThe Apache plugin probably did too... except it hasn't been updated since 2014: 2faacc1b43786edd5386305f9cffec376b5a5d26\r\n\r\nShould Certbot's Apache settings be updated?\r\n\r\nThe main difference is that the new configuration adds ChaCha20 cipher suites. (It also removes a few things.)\r\n\r\nShould this wait until after further documentation/feature improvements in #4830?\r\n\r\nIf so, how about a stopgap patch to add ChaCha20 without removing anything?\r\n\r\nDifferences with OpenSSL 1.0.2 or 1.1.0:\r\n\r\n* Adds ChaCha20. (Yay!)\r\n* Adds newer 3DES cipher suites with key exchange/signature algorithms other than RSA/RSA. (Probably doesn't matter. Anything that supports ECDHE-ECDSA ought to support a better cipher than 3DES. ) (Edit: Mozilla suggests that EDH-RSA 3DES is useful, though,.)\r\n* Removes AES-CCM. (OpenSSL 1.1. Probably only included inadvertently.)\r\n* Removes Camellia. (Perfectly nice cipher, but everybody uses AES.)\r\n* Removes some static DH and SRP key exchange cipher suites. (Probably only included by accident, mostly or entirely ignored by servers and clients.)\r\n* Changes the order of some things.\n", "before_files": [{"content": "\"\"\"Apache plugin constants.\"\"\"\nimport pkg_resources\n\n\nMOD_SSL_CONF_DEST = \"options-ssl-apache.conf\"\n\"\"\"Name of the mod_ssl config file as saved in `IConfig.config_dir`.\"\"\"\n\n\nUPDATED_MOD_SSL_CONF_DIGEST = \".updated-options-ssl-apache-conf-digest.txt\"\n\"\"\"Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`.\"\"\"\n\nALL_SSL_OPTIONS_HASHES = [\n    '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',\n    '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',\n    '5a922826719981c0a234b1fbcd495f3213e49d2519e845ea0748ba513044b65b',\n    '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',\n    'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',\n    'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',\n]\n\"\"\"SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC\"\"\"\n\nAUGEAS_LENS_DIR = pkg_resources.resource_filename(\n    \"certbot_apache\", \"augeas_lens\")\n\"\"\"Path to the Augeas lens directory\"\"\"\n\nREWRITE_HTTPS_ARGS = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,NE,R=permanent]\"]\n\"\"\"Apache version<2.3.9 rewrite rule arguments used for redirections to\nhttps vhost\"\"\"\n\nREWRITE_HTTPS_ARGS_WITH_END = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,NE,R=permanent]\"]\n\"\"\"Apache version >= 2.3.9 rewrite rule arguments used for redirections to\n    https vhost\"\"\"\n\nOLD_REWRITE_HTTPS_ARGS = [\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,QSA,R=permanent]\"],\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,QSA,R=permanent]\"]]\n\nHSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n             \"\\\"max-age=31536000\\\"\"]\n\"\"\"Apache header arguments for HSTS\"\"\"\n\nUIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n            \"upgrade-insecure-requests\"]\n\nHEADER_ARGS = {\"Strict-Transport-Security\": HSTS_ARGS,\n               \"Upgrade-Insecure-Requests\": UIR_ARGS}\n", "path": "certbot-apache/certbot_apache/constants.py"}], "after_files": [{"content": "\"\"\"Apache plugin constants.\"\"\"\nimport pkg_resources\n\n\nMOD_SSL_CONF_DEST = \"options-ssl-apache.conf\"\n\"\"\"Name of the mod_ssl config file as saved in `IConfig.config_dir`.\"\"\"\n\n\nUPDATED_MOD_SSL_CONF_DIGEST = \".updated-options-ssl-apache-conf-digest.txt\"\n\"\"\"Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`.\"\"\"\n\nALL_SSL_OPTIONS_HASHES = [\n    '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',\n    '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',\n    '5a922826719981c0a234b1fbcd495f3213e49d2519e845ea0748ba513044b65b',\n    '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',\n    'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',\n    'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',\n    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',\n    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',\n]\n\"\"\"SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC\"\"\"\n\nAUGEAS_LENS_DIR = pkg_resources.resource_filename(\n    \"certbot_apache\", \"augeas_lens\")\n\"\"\"Path to the Augeas lens directory\"\"\"\n\nREWRITE_HTTPS_ARGS = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,NE,R=permanent]\"]\n\"\"\"Apache version<2.3.9 rewrite rule arguments used for redirections to\nhttps vhost\"\"\"\n\nREWRITE_HTTPS_ARGS_WITH_END = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,NE,R=permanent]\"]\n\"\"\"Apache version >= 2.3.9 rewrite rule arguments used for redirections to\n    https vhost\"\"\"\n\nOLD_REWRITE_HTTPS_ARGS = [\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,QSA,R=permanent]\"],\n    [\"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,QSA,R=permanent]\"]]\n\nHSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n             \"\\\"max-age=31536000\\\"\"]\n\"\"\"Apache header arguments for HSTS\"\"\"\n\nUIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n            \"upgrade-insecure-requests\"]\n\nHEADER_ARGS = {\"Strict-Transport-Security\": HSTS_ARGS,\n               \"Upgrade-Insecure-Requests\": UIR_ARGS}\n", "path": "certbot-apache/certbot_apache/constants.py"}]}