SSLStrictSNIVHostCheck off

<VirtualHost *:${APACHE_SSL_PORT}>
	ServerAdmin ${APACHE_SERVER_ADMIN}
	ServerName ${SERVER_NAME}

	DocumentRoot /var/www/html

	LogLevel ${APACHE_LOG_LEVEL} ssl:${APACHE_SSL_LOG_LEVEL}

	ErrorLog ${APACHE_LOG_DIR}/${SERVER_NAME}_error.log
	CustomLog ${APACHE_LOG_DIR}/${SERVER_NAME}_access.log "%h %{SSL_PROTOCOL}x %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""

	SSLEngine on

	SSLCertificateFile /etc/letsencrypt/live/${SERVER_NAME}/${APACHE_SSL_CERTS}
	SSLCertificateKeyFile /etc/letsencrypt/live/${SERVER_NAME}/${APACHE_SSL_PRIVATE}

	SSLCACertificatePath /etc/ssl/itaca/
	SSLInsecureRenegotiation on

	OIDCProviderMetadataURL https://is-test.regione.sicilia.it:443/oauth2/token/.well-known/openid-configuration
	OIDCClientID sJs9yMsWWz8K2Vkvys1F37zmtwwa
	OIDCRedirectURI https://${SERVER_NAME}/spid/callback/
	OIDCClientName SISMICA
	OIDCClientContact admin@mwg.it
	OIDCCryptoPassphrase zyNVgGtYvDh5d7RqsSvnz8EYR2a8
	OIDCClaimPrefix SPID_claim_
	OIDCPassClaimsAs environment
	OIDCPublicKeyFiles "auth#/etc/apache2/keys/public.pem"
	OIDCPrivateKeyFiles "auth#/etc/apache2/keys/private.pem"

	<Directory "/var/www/html">
		Require all granted
		AllowOverride All
		Options -MultiViews +SymLinksIfOwnerMatch
		SSLOptions +StdEnvVars

		#Order Allow,Deny
		#Allow from 79.8.172.13
		#Allow from 80.17.206.46
	</Directory>

	<Directory "/var/www/html/cns">
		AllowOverride None

		SSLVerifyClient ${APACHE_SSL_VERIFY_CLIENT}
		SSLRenegBufferSize 16777216
		SSLVerifyDepth 10
		SSLOptions +ExportCertData +StdEnvVars +OptRenegotiate

		SSLUserName SSL_CLIENT_S_DN_CN

		<If "env('APACHE_SSL_VERIFY_CLIENT') =~ /optional|optional_no_ca/">
			RewriteEngine on
			RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
			RewriteRule .? - [F]
			ErrorDocument 403 ${CLIENT_VERIFY_LANDING_PAGE}
		</If>
	</Directory>

	<Directory "/var/www/html/spid">
		Options -Indexes
	</Directory>

	<Location "/spid">
		AuthType openid-connect
		Require valid-user
	</Location>
</VirtualHost>