docs: update SSL config — ECDSA keys, TLS 1.2+, Let's Encrypt

[somethingwithproof]

Summary

The existing SSL configuration guide prescribed RSA 2048-bit keys and provided no TLS protocol or cipher guidance, leaving users with insecure defaults.

Key changes:

• Replace RSA 2048 with ECDSA secp384r1 (recommended) and RSA 4096 (alternative); add note that 2048-bit is below NIST SP 800-131A Rev 2 guidance
• Add Apache SSLProtocol directive restricting to TLS 1.2+ (TLS 1.0/1.1 prohibited by RFC 8996)
• Add SSLCipherSuite with modern AEAD suites; remove 3DES (Sweet32 vulnerability)
• Add HTTP→HTTPS redirect <VirtualHost> block
• Add Let's Encrypt section for both RHEL/Rocky/AlmaLinux and Debian/Ubuntu
• Add post-install verification using openssl s_client and testssl.sh
• Replace yum (with duplicate -y) with dnf
• Fix "HTTP" → "HTTPS" in description text

Test plan

• Verify Apache config blocks are syntactically valid
• Confirm openssl commands produce keys in expected locations
• Verify Let's Encrypt certbot commands are current

[Copilot]

Pull request overview

Updates the Cacti SSL configuration guide to provide more secure, modern HTTPS defaults (stronger key types/sizes, TLS 1.2+ guidance, modern cipher guidance) and adds a Let’s Encrypt workflow plus verification steps.

Changes:

• Refresh self-signed certificate instructions (ECDSA P-384 recommended; RSA 4096 alternative) and replace yum with dnf.
• Add an Apache HTTPS vhost example with TLS 1.2+ protocol restriction, cipher guidance, and an HTTP→HTTPS redirect example.
• Add Let’s Encrypt (certbot) steps for RHEL-family and Debian/Ubuntu, plus post-install verification commands.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[somethingwithproof]

All 5 review threads are already addressed by the follow-up commit on this branch (docs(ssl): fix RHEL certbot install and note Debian cert paths): the HTTP->HTTPS redirect block is commented out by default, TLS 1.3 ciphers get their own SSLOpenSSLConfCmd line, the Apache example now uses Debian/Ubuntu paths with a note on the RHEL alternative, and both the ECDSA and RSA self-signed cert commands include a SAN via -addext subjectAltName. No further changes needed; resolving.