diff --git a/roles/collabora/tasks/ssl-dev.yml b/roles/collabora/tasks/ssl-dev.yml
index 678de5e..e0c85c5 100644
--- a/roles/collabora/tasks/ssl-dev.yml
+++ b/roles/collabora/tasks/ssl-dev.yml
@@ -4,14 +4,6 @@
     name: pyOpenSSL
     state: present
 
-- name: Copy LetsEncrypt Apache config
-  template:
-    src: etc/letsencrypt/options-ssl-apache.conf.j2
-    dest: /etc/letsencrypt/options-ssl-apache.conf
-    owner: root
-    group: root
-    mode: 0644
-
 - name: Ensure directory exists for local self-signed TLS certs.
   file:
     path: /etc/letsencrypt/live/{{ collabora_domain }}
diff --git a/roles/letsencrypt/tasks/main.yml b/roles/letsencrypt/tasks/main.yml
index a7f1720..8b9cb5e 100644
--- a/roles/letsencrypt/tasks/main.yml
+++ b/roles/letsencrypt/tasks/main.yml
@@ -7,3 +7,10 @@
     name: python-certbot-apache
     state: latest
     update_cache: yes
+- name: Copy LetsEncrypt apache config
+  template:
+    src: etc/letsencrypt/options-ssl-apache.conf.j2
+    dest: /etc/letsencrypt/options-ssl-apache.conf
+    owner: root
+    group: root
+    mode: 0644
diff --git a/roles/letsencrypt/templates/etc/letsencrypt/options-ssl-apache.conf.j2 b/roles/letsencrypt/templates/etc/letsencrypt/options-ssl-apache.conf.j2
new file mode 100644
index 0000000..8113ee8
--- /dev/null
+++ b/roles/letsencrypt/templates/etc/letsencrypt/options-ssl-apache.conf.j2
@@ -0,0 +1,26 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file.
+
+SSLEngine on
+
+# Intermediate configuration, tweak to your needs
+SSLProtocol             all -SSLv2 -SSLv3
+SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
+SSLHonorCipherOrder     on
+SSLCompression          off
+
+SSLOptions +StrictRequire
+
+# Add vhost name to log entries:
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
+LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
+
+#CustomLog /var/log/apache2/access.log vhost_combined
+#LogLevel warn
+#ErrorLog /var/log/apache2/error.log
+
+# Always ensure Cookies have "Secure" set (JAH 2012/1)
+#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"