diff --git a/certbot-apache/src/certbot_apache/_internal/constants.py b/certbot-apache/src/certbot_apache/_internal/constants.py
index 14af59fa8..9c9c2f56b 100644
--- a/certbot-apache/src/certbot_apache/_internal/constants.py
+++ b/certbot-apache/src/certbot_apache/_internal/constants.py
@@ -33,6 +33,7 @@ ALL_SSL_OPTIONS_HASHES: list[str] = [
     '61466bc2f98a623c02be8a5ee916ead1655b0ce883bdc936692076ea499ff5ce',
     '3fd812e3e87fe5c645d3682a511b2a06c8286f19594f28e280f17cd6af1301b5',
     '27155797e160fe43b6951354a0a0ca4d829e9e605b3b41fc223c20bf2f6cb3c6',
+    '3a6881d0a7e5740b039ec550c916105259f53b577a3d38d0ed11bd675bfeab88',
 ]
 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""
 
diff --git a/certbot-apache/src/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf b/certbot-apache/src/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf
index cb7583151..e8265fda5 100644
--- a/certbot-apache/src/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf
+++ b/certbot-apache/src/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf
@@ -8,7 +8,8 @@ SSLEngine on
 
 # Intermediate configuration, tweak to your needs
 SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+SSLOpenSSLConfCmd       Curves X25519:prime256v1:secp384r1
+SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
 SSLHonorCipherOrder     off
 SSLSessionTickets       off
 
diff --git a/newsfragments/10443.changed b/newsfragments/10443.changed
new file mode 100644
index 000000000..ccf7aaa8b
--- /dev/null
+++ b/newsfragments/10443.changed
@@ -0,0 +1,3 @@
+Updated apache TLS configuration options based on changes to Mozilla's intermediate configuration recommendations.
+* Added `DHE-RSA-CHACHA20-POLY1305` to `SSLCipherSuite` list for better compliance
+* Configured curves using `SSLOpenSSLConfCmd` so FFDH won't be used with OpenSSL 3.0