Fixed #2.

If I had to blindly guess on #1, it's that the config has SSLCertificateFile and SSLCertificateKeyFile, but lacks SSLCertificateChainFile, which should point at a copy of the cert shown in https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO26457 . Also, delete any line with SSLCACertificatePath at the same time, if that exists.

Fix for #1 + #2 works, thanks!

The deprecation thing is accurate, but the ChainFile method still works. We've just been configuring all of our in-house apaches the deprecated way because it works consistently across all the versions that we run. The not-deprecated way is to remove the ChainFile directive and append the contents of that file to the main certificate file.

Also, found a third issue - it's missing HSTS header output (a past audit said that it had HSTS, maybe that got dropped during some later re-config, maybe during switch to Jessie?). Should just require this at the VirtualHost level for the SSL virtualhost:

Header always set Strict-Transport-Security "max-age=31536000"

(edited above - #1 + #2 are fixed)

In T133360#2229474, @BBlack wrote:

The deprecation thing is accurate, but the ChainFile method still works. We've just been configuring all of our in-house apaches the deprecated way because it works consistently across all the versions that we run. The not-deprecated way is to remove the ChainFile directive and append the contents of that file to the main certificate file.

Yeah, I used the non-deprecated way.

In T133360#2229474, @BBlack wrote:

Also, found a third issue - it's missing HSTS header output (a past audit said that it had HSTS, maybe that got dropped during some later re-config, maybe during switch to Jessie?). Should just require this at the VirtualHost level for the SSL virtualhost:

Header always set Strict-Transport-Security "max-age=31536000"

I copied over all the apache configs during the migration, not sure what happened with that. I wouldn't normally set this sort of header myself for a service like wikitech-static, but I'm going to trust your judgement on this topic. :)
I had to a2enmod headers to get it working.

Do you want to open a separate ticket for fixing ops access to the machine? @Dzahn should have the credentials somewhere, alternatively there's probably some way in through the web panel, or if the right people approve I suppose I could set a new root password for you.

For all I know the STS header may have been previously-set in mediawiki config somehow, too, no idea on that. But it's outputting the right header now, so #3 fixed as well. ssllabs back up to A+ now.

Yeah I'll make a separate ticket about access not working as expected.