diff --git a/.gitignore b/.gitignore
index 19a3666..b1c1924 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,7 +10,7 @@ x86_64
 /httpd-2.2.21.tar.bz2
 /clog
 /httpd-2.2.22.tar.bz2
-/httpd-2.4.?
+/httpd-2.4.??/
 /httpd-2.4.2.tar.bz2
 /httpd-2.4.3.tar.bz2
 /httpd-2.4.4.tar.bz2
@@ -28,3 +28,5 @@ x86_64
 /httpd.service.8
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
+/httpd-2.4.28.tar.bz2
+/httpd-2.4.29.tar.bz2
diff --git a/00-proxy.conf b/00-proxy.conf
index 448eb63..f0f84c2 100644
--- a/00-proxy.conf
+++ b/00-proxy.conf
@@ -14,4 +14,5 @@ LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 LoadModule proxy_http_module modules/mod_proxy_http.so
 LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
 LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
 LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
diff --git a/01-md.conf b/01-md.conf
new file mode 100644
index 0000000..2739202
--- /dev/null
+++ b/01-md.conf
@@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so
diff --git a/httpd-2.4.10-sigint.patch b/httpd-2.4.10-sigint.patch
deleted file mode 100644
index ecdd82e..0000000
--- a/httpd-2.4.10-sigint.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
-index 559f90a..a386a75 100644
---- a/server/mpm/prefork/prefork.c
-+++ b/server/mpm/prefork/prefork.c
-@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
- {
-     retained->mpm->mpm_state = AP_MPMQ_STOPPING;
- 
-+    apr_signal(SIGHUP, SIG_IGN);
-+    apr_signal(SIGTERM, SIG_IGN);
-+
-     if (pchild) {
-         apr_pool_destroy(pchild);
-     }
-@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
-          */
-         apr_signal(SIGHUP, just_die);
-         apr_signal(SIGTERM, just_die);
-+        /* Ignore SIGINT in child. This fixes race-condition in signals
-+         * handling when httpd is runnning on foreground and user hits ctrl+c.
-+         * In this case, SIGINT is sent to all children followed by SIGTERM
-+         * from the main process, which interrupts the SIGINT handler and
-+         * leads to inconsistency.
-+         */
-+        apr_signal(SIGINT, SIG_IGN);
-         /* The child process just closes listeners on AP_SIG_GRACEFUL.
-          * The pod is used for signalling the graceful restart.
-          */
diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.17-socket-activation.patch
index d5cbdf2..dbdd80c 100644
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.17-socket-activation.patch
@@ -1,5 +1,5 @@
 diff --git a/server/listen.c b/server/listen.c
-index 1d9be83..f5f7754 100644
+index a8e9e6f..1a6c1d3 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,6 +34,10 @@
@@ -100,11 +100,10 @@ index 1d9be83..f5f7754 100644
      }
  
  #ifdef WIN32
-@@ -277,6 +286,124 @@ static apr_status_t close_listeners_on_exec(void *v)
-     return APR_SUCCESS;
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
  }
  
-+
 +#ifdef HAVE_SYSTEMD
 +
 +static int find_systemd_socket(process_rec * process, apr_port_t port) {
@@ -222,10 +221,10 @@ index 1d9be83..f5f7754 100644
 +
 +#endif /* HAVE_SYSTEMD */
 +
- static const char *alloc_listener(process_rec *process, char *addr,
+ static const char *alloc_listener(process_rec *process, const char *addr,
                                    apr_port_t port, const char* proto,
                                    void *slave)
-@@ -479,7 +606,7 @@ static int open_listeners(apr_pool_t *pool)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
                  }
              }
  #endif
@@ -234,7 +233,7 @@ index 1d9be83..f5f7754 100644
                  ++num_open;
              }
              else {
-@@ -591,8 +718,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
          }
      }
  
@@ -265,7 +264,7 @@ index 1d9be83..f5f7754 100644
      }
  
      for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -682,7 +829,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
                              duplr->bind_addr);
                  return stat;
              }
@@ -274,7 +273,7 @@ index 1d9be83..f5f7754 100644
  #if AP_NONBLOCK_WHEN_MULTI_LISTEN
              use_nonblock = (ap_listeners && ap_listeners->next);
              stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -809,6 +956,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      if (argc < 1 || argc > 2) {
          return "Listen requires 1 or 2 arguments.";
      }
@@ -286,7 +285,7 @@ index 1d9be83..f5f7754 100644
  
      rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
      if (rv != APR_SUCCESS) {
-@@ -840,6 +992,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
          ap_str_tolower(proto);
      }
  
diff --git a/httpd-2.4.26-r1800306.patch b/httpd-2.4.26-r1800306.patch
deleted file mode 100644
index 4a8bc2d..0000000
--- a/httpd-2.4.26-r1800306.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-# ./pullrev.sh 1800306
-
-http://svn.apache.org/viewvc?view=revision&revision=1800306
-
-diff -uap httpd-2.4.26/modules/mappers/mod_actions.c.r1800306 httpd-2.4.26/modules/mappers/mod_actions.c
---- httpd-2.4.26/modules/mappers/mod_actions.c.r1800306
-+++ httpd-2.4.26/modules/mappers/mod_actions.c
-@@ -186,8 +186,7 @@
-         ap_field_noparam(r->pool, r->content_type);
- 
-     if (action && (t = apr_table_get(conf->action_types, action))) {
--        int virtual = (*t++ == '0' ? 0 : 1);
--        if (!virtual && r->finfo.filetype == APR_NOFILE) {
-+        if (*t++ == '0' && r->finfo.filetype == APR_NOFILE) {
-             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00652)
-                           "File does not exist: %s", r->filename);
-             return HTTP_NOT_FOUND;
-@@ -198,9 +197,6 @@
-          * (will be REDIRECT_HANDLER there)
-          */
-         apr_table_setn(r->subprocess_env, "HANDLER", action);
--        if (virtual) {
--            apr_table_setn(r->notes, "virtual_script", "1");
--        }
-     }
- 
-     if (script == NULL)
-diff -uap httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306 httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
---- httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306
-+++ httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
-@@ -321,7 +321,6 @@
-     apr_status_t rv;
-     apr_size_t avail_len, len, required_len;
-     int next_elem, starting_elem;
--    int fpm = 0;
-     fcgi_req_config_t *rconf = ap_get_module_config(r->request_config, &proxy_fcgi_module);
-     fcgi_dirconf_t *dconf = ap_get_module_config(r->per_dir_config, &proxy_fcgi_module);
- 
-@@ -354,8 +353,6 @@
-                     *qs = '\0';
-                 }
-             }
--        } else {
--            fpm = 1;
-         }
- 
-         if (newfname) {
-@@ -364,38 +361,9 @@
-         }
-     }
- 
--#if 0
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->filename: %s", (r->filename ? r->filename : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->uri: %s", (r->uri ? r->uri : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->path_info: %s", (r->path_info ? r->path_info : "nil"));
--#endif
--
-     ap_add_common_vars(r);
-     ap_add_cgi_vars(r);
- 
--    if (fpm || apr_table_get(r->notes, "virtual_script")) {
--        /*
--         * Adjust SCRIPT_NAME, PATH_INFO and PATH_TRANSLATED for PHP-FPM
--         * TODO: Right now, PATH_INFO and PATH_TRANSLATED look OK...
--         */
--        const char *pend;
--        const char *script_name = apr_table_get(r->subprocess_env, "SCRIPT_NAME");
--        pend = script_name + strlen(script_name);
--        if (r->path_info && *r->path_info) {
--            pend = script_name + ap_find_path_info(script_name, r->path_info) - 1;
--        }
--        while (pend != script_name && *pend != '/') {
--            pend--;
--        }
--        apr_table_setn(r->subprocess_env, "SCRIPT_NAME", pend);
--        ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r,
--                      "fpm:virtual_script: Modified SCRIPT_NAME to: %s",
--                      pend);
--    }
--
-     /* XXX are there any FastCGI specific env vars we need to send? */
- 
-     /* Give admins final option to fine-tune env vars */
diff --git a/httpd-2.4.10-mod_systemd.patch b/httpd-2.4.27-systemd.patch
similarity index 79%
rename from httpd-2.4.10-mod_systemd.patch
rename to httpd-2.4.27-systemd.patch
index 88d76ac..26aac48 100644
--- a/httpd-2.4.10-mod_systemd.patch
+++ b/httpd-2.4.27-systemd.patch
@@ -1,8 +1,10 @@
-diff --git a/modules/arch/unix/config5.m4 b/modules/arch/unix/config5.m4
-index 77027a8..7a13d5a 100644
---- a/modules/arch/unix/config5.m4
-+++ b/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@ APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+--- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.27/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
    fi
  ])
  
@@ -19,12 +21,10 @@ index 77027a8..7a13d5a 100644
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
  
  APACHE_MODPATH_FINISH
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-new file mode 100644
-index 0000000..5381c98
---- /dev/null
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,145 @@
+diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
+--- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,161 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -66,11 +66,20 @@ index 0000000..5381c98
 +static unsigned long bytes_served;
 +static pid_t mainpid;
 +
++static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
++                              apr_pool_t *ptemp)
++{
++    sd_notify(0,
++              "RELOADING=1\n"
++              "STATUS=Reading configuration...\n");
++    ap_extended_status = 1;
++    return OK;
++}
++
 +static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
 +{
 +    int rv;
 +
-+    ap_extended_status = 1;
 +    mainpid = getpid();
 +
 +    rv = sd_notifyf(0, "READY=1\n"
@@ -91,6 +100,11 @@ index 0000000..5381c98
 +    char bps[5];
 +    int rv;
 +
++    if (!ap_extended_status) {
++        /* Nothing useful to report if ExtendedStatus disabled. */
++        return DECLINED;
++    }
++    
 +    ap_get_sload(&sload);
 +    /* up_time in seconds */
 +    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
@@ -136,6 +150,8 @@ index 0000000..5381c98
 +
 +static void systemd_register_hooks(apr_pool_t *p)
 +{
++    /* Enable ap_extended_status. */
++    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
 +    /* We know the PID in this hook ... */
 +    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
 +    /* Used to update httpd's status line using sd_notifyf */
diff --git a/httpd-2.4.4-export.patch b/httpd-2.4.33-export.patch
similarity index 75%
rename from httpd-2.4.4-export.patch
rename to httpd-2.4.33-export.patch
index eb670c6..9adf398 100644
--- a/httpd-2.4.4-export.patch
+++ b/httpd-2.4.33-export.patch
@@ -6,12 +6,12 @@ Upstream-HEAD: needed
 Upstream-2.0: omit
 Upstream-Status: EXPORT_DIRS change is conditional on using shared apr
 
---- httpd-2.4.4/server/Makefile.in.export
-+++ httpd-2.4.4/server/Makefile.in
-@@ -57,9 +57,6 @@ export_files:
- 	( for dir in $(EXPORT_DIRS); do \
+--- httpd-2.4.33/server/Makefile.in.export
++++ httpd-2.4.33/server/Makefile.in
+@@ -60,9 +60,6 @@
  	      ls $$dir/*.h ; \
  	  done; \
+ 	  echo "$(top_srcdir)/server/mpm_fdqueue.h"; \
 -	  for dir in $(EXPORT_DIRS_APR); do \
 -	      ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \
 -	  done; \
diff --git a/httpd-2.4.33-mddefault.patch b/httpd-2.4.33-mddefault.patch
new file mode 100644
index 0000000..9e82fb8
--- /dev/null
+++ b/httpd-2.4.33-mddefault.patch
@@ -0,0 +1,21 @@
+
+Override default.
+
+--- httpd-2.4.33/modules/md/mod_md_config.c.mddefault
++++ httpd-2.4.33/modules/md/mod_md_config.c
+@@ -54,10 +54,14 @@
+ 
+ #define DEF_VAL     (-1)
+ 
++#ifndef MD_DEFAULT_STORE_DIR
++#define MD_DEFAULT_STORE_DIR "state/md"
++#endif
++
+ /* Default settings for the global conf */
+ static md_mod_conf_t defmc = {
+     NULL,
+-    "md",
++    MD_DEFAULT_STORE_DIR,
+     NULL,
+     NULL,
+     80,
diff --git a/httpd-2.4.25-r1738878.patch b/httpd-2.4.33-r1738878.patch
similarity index 71%
rename from httpd-2.4.25-r1738878.patch
rename to httpd-2.4.33-r1738878.patch
index e4b46cc..d7ef42f 100644
--- a/httpd-2.4.25-r1738878.patch
+++ b/httpd-2.4.33-r1738878.patch
@@ -1,28 +1,9 @@
 diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
 index c119a7e..267150a 100644
---- a/modules/proxy/ajp.h
-+++ b/modules/proxy/ajp.h
-@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
-  * @param sock      backend socket
-  * @param r         current request
-  * @param buffsize  max size of the AJP packet.
-+ * @param secret    authentication secret
-  * @param uri       requested uri
-  * @return          APR_SUCCESS or error
-  */
- apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri);
-+                             apr_uri_t *uri,
-+                             const char *secret);
- 
- /**
-  * Read the ajp message and return the type of the message.
-diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
-index 67353a7..680a8f3 100644
---- a/modules/proxy/ajp_header.c
-+++ b/modules/proxy/ajp_header.c
-@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
+diff -uap httpd-2.4.33/modules/proxy/ajp_header.c.r1738878 httpd-2.4.33/modules/proxy/ajp_header.c
+--- httpd-2.4.33/modules/proxy/ajp_header.c.r1738878
++++ httpd-2.4.33/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@
  
  static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
                                            request_rec *r,
@@ -32,7 +13,7 @@ index 67353a7..680a8f3 100644
  {
      int method;
      apr_uint32_t i, num_headers = 0;
-@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+@@ -293,17 +294,15 @@
                     i, elts[i].key, elts[i].val);
      }
  
@@ -53,7 +34,7 @@ index 67353a7..680a8f3 100644
  
      if (r->user) {
          if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
-@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+@@ -671,7 +670,8 @@
  apr_status_t ajp_send_header(apr_socket_t *sock,
                               request_rec *r,
                               apr_size_t buffsize,
@@ -63,7 +44,7 @@ index 67353a7..680a8f3 100644
  {
      ajp_msg_t *msg;
      apr_status_t rc;
-@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
+@@ -683,7 +683,7 @@
          return rc;
      }
  
@@ -72,48 +53,29 @@ index 67353a7..680a8f3 100644
      if (rc != APR_SUCCESS) {
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
                 "ajp_send_header: ajp_marshal_into_msgb failed");
-diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
-index f6fb473..f693f63 100644
---- a/modules/proxy/mod_proxy.c
-+++ b/modules/proxy/mod_proxy.c
-@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p,
-                                 (int)sizeof(worker->s->upgrade));
-         }
-     }
-+    else if (!strcasecmp(key, "secret")) {
-+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
-+            return apr_psprintf(p, "Secret length must be < %d characters",
-+                                (int)sizeof(worker->s->secret));
-+        }
-+    }
-     else {
-         if (set_worker_hc_param_f) {
-             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
-diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
-index 8a0ad10..f92c185 100644
---- a/modules/proxy/mod_proxy.h
-+++ b/modules/proxy/mod_proxy.h
-@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL )
- #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
- #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
- #define PROXY_BALANCER_MAX_STICKY_SIZE  64
-+#define PROXY_WORKER_MAX_SECRET_SIZE    64
+diff -uap httpd-2.4.33/modules/proxy/ajp.h.r1738878 httpd-2.4.33/modules/proxy/ajp.h
+--- httpd-2.4.33/modules/proxy/ajp.h.r1738878
++++ httpd-2.4.33/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
++ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
++                             apr_uri_t *uri,
++                             const char *secret);
  
- /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
-  * dotted together(?) this would fit the below size (+ trailing NUL).
-@@ -443,6 +444,7 @@ typedef struct {
-     hcmethod_t      method;     /* method to use for health check */
-     apr_interval_time_t interval;
-     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
-+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
- } proxy_worker_shared;
- 
- #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
-diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
-index 051724e..e706518 100644
---- a/modules/proxy/mod_proxy_ajp.c
-+++ b/modules/proxy/mod_proxy_ajp.c
-@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+ /**
+  * Read the ajp message and return the type of the message.
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+--- httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@
      apr_off_t content_length = 0;
      int original_status = r->status;
      const char *original_status_line = r->status_line;
@@ -121,7 +83,7 @@ index 051724e..e706518 100644
  
      if (psf->io_buffer_size_set)
         maxsize = psf->io_buffer_size;
-@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+@@ -202,12 +203,15 @@
         maxsize = AJP_MSG_BUFFER_SZ;
      maxsize = APR_ALIGN(maxsize, 1024);
  
@@ -138,3 +100,38 @@ index 051724e..e706518 100644
      if (status != APR_SUCCESS) {
          conn->close = 1;
          ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.c
+--- httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.c
+@@ -318,6 +318,12 @@
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
++    else if (!strcasecmp(key, "secret")) {
++        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
++            return apr_psprintf(p, "Secret length must be < %d characters",
++                                (int)sizeof(worker->s->secret));
++        }
++    }
+     else {
+         if (set_worker_hc_param_f) {
+             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.h
+--- httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.h
+@@ -353,6 +353,7 @@
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
++#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ #define PROXY_RFC1035_HOSTNAME_SIZE	256
+ 
+@@ -447,6 +448,7 @@
+     apr_interval_time_t interval;
+     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
+     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
++    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
diff --git a/httpd-2.4.17-sslciphdefault.patch b/httpd-2.4.33-sslciphdefault.patch
similarity index 75%
rename from httpd-2.4.17-sslciphdefault.patch
rename to httpd-2.4.33-sslciphdefault.patch
index 8efc461..f2919b8 100644
--- a/httpd-2.4.17-sslciphdefault.patch
+++ b/httpd-2.4.33-sslciphdefault.patch
@@ -3,9 +3,9 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1109119
 
 Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 
---- httpd-2.4.17/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.17/modules/ssl/ssl_engine_config.c
-@@ -708,8 +708,10 @@ const char *ssl_cmd_SSLCipherSuite(cmd_p
+--- httpd-2.4.33/modules/ssl/ssl_engine_config.c.sslciphdefault
++++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
+@@ -758,8 +758,10 @@
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
@@ -18,9 +18,9 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
  
      if (cmd->path) {
          dc->szCipherSuite = arg;
-@@ -1428,8 +1430,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(
+@@ -1502,8 +1504,10 @@
  {
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
 -    /* always disable null and export ciphers */
 -    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
@@ -29,5 +29,5 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 +    if (strncmp(arg, "PROFILE=", 8) != 0)
 +        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
  
-     sc->proxy->auth.cipher_suite = arg;
+     dc->proxy->auth.cipher_suite = arg;
  
diff --git a/httpd-2.4.33-sslmerging.patch b/httpd-2.4.33-sslmerging.patch
new file mode 100644
index 0000000..066b5c8
--- /dev/null
+++ b/httpd-2.4.33-sslmerging.patch
@@ -0,0 +1,15 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+
+--- httpd-2.4.33/modules/ssl/ssl_engine_init.c.sslmerging
++++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
+@@ -261,7 +261,8 @@
+          * the protocol is https. */
+         if (ap_get_server_protocol(s) 
+             && strcmp("https", ap_get_server_protocol(s)) == 0
+-            && sc->enabled == SSL_ENABLED_UNSET) {
++            && sc->enabled == SSL_ENABLED_UNSET
++            && (!apr_is_empty_array(sc->server->pks->cert_files))) {
+             sc->enabled = SSL_ENABLED_TRUE;
+         }
+ 
diff --git a/httpd-2.4.4-mod_unique_id.patch b/httpd-2.4.4-mod_unique_id.patch
deleted file mode 100644
index 30bdfe0..0000000
--- a/httpd-2.4.4-mod_unique_id.patch
+++ /dev/null
@@ -1,239 +0,0 @@
---- trunk/modules/metadata/mod_unique_id.c	2011/12/02 23:02:04	1209766
-+++ trunk/modules/metadata/mod_unique_id.c	2013/07/10 16:20:31	1501827
-@@ -31,14 +31,11 @@
- #include "http_log.h"
- #include "http_protocol.h"  /* for ap_hook_post_read_request */
- 
--#if APR_HAVE_UNISTD_H
--#include <unistd.h>         /* for getpid() */
--#endif
-+#define ROOT_SIZE 10
- 
- typedef struct {
-     unsigned int stamp;
--    unsigned int in_addr;
--    unsigned int pid;
-+    char root[ROOT_SIZE];
-     unsigned short counter;
-     unsigned int thread_index;
- } unique_id_rec;
-@@ -64,20 +61,15 @@
-  * gethostbyname (gethostname()) is unique across all the machines at the
-  * "site".
-  *
-- * We also further assume that pids fit in 32-bits.  If something uses more
-- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding
-- * loop to be extended.  * A similar fix is needed to support multithreaded
-- * servers, using a pid/tid combo.
-- *
-- * Together, the in_addr and pid are assumed to absolutely uniquely identify
-- * this one child from all other currently running children on all servers
-- * (including this physical server if it is running multiple httpds) from each
-+ * The root is assumed to absolutely uniquely identify this one child
-+ * from all other currently running children on all servers (including
-+ * this physical server if it is running multiple httpds) from each
-  * other.
-  *
-- * The stamp and counter are used to distinguish all hits for a particular
-- * (in_addr,pid) pair.  The stamp is updated using r->request_time,
-- * saving cpu cycles.  The counter is never reset, and is used to permit up to
-- * 64k requests in a single second by a single child.
-+ * The stamp and counter are used to distinguish all hits for a
-+ * particular root.  The stamp is updated using r->request_time,
-+ * saving cpu cycles.  The counter is never reset, and is used to
-+ * permit up to 64k requests in a single second by a single child.
-  *
-  * The 144-bits of unique_id_rec are encoded using the alphabet
-  * [A-Za-z0-9@-], resulting in 24 bytes of printable characters.  That is then
-@@ -92,7 +84,7 @@
-  * module change.
-  *
-  * It is highly desirable that identifiers exist for "eternity".  But future
-- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a
-+ * needs (such as much faster webservers, or moving to a
-  * multithreaded server) may dictate a need to change the contents of
-  * unique_id_rec.  Such a future implementation should ensure that the first
-  * field is still a time_t stamp.  By doing that, it is possible for a site to
-@@ -100,7 +92,15 @@
-  * wait one entire second, and then start all of their new-servers.  This
-  * procedure will ensure that the new space of identifiers is completely unique
-  * from the old space.  (Since the first four unencoded bytes always differ.)
-+ *
-+ * Note: previous implementations used 32-bits of IP address plus pid
-+ * in place of the PRNG output in the "root" field.  This was
-+ * insufficient for IPv6-only hosts, required working DNS to determine
-+ * a unique IP address (fragile), and needed a [0, 1) second sleep
-+ * call at startup to avoid pid reuse.  Use of the PRNG avoids all
-+ * these issues.
-  */
-+
- /*
-  * Sun Jun  7 05:43:49 CEST 1998 -- Alvaro
-  * More comments:
-@@ -116,8 +116,6 @@
-  * htonl/ntohl. Well, this shouldn't be a problem till year 2106.
-  */
- 
--static unsigned global_in_addr;
--
- /*
-  * XXX: We should have a per-thread counter and not use cur_unique_id.counter
-  * XXX: in all threads, because this is bad for performance on multi-processor
-@@ -129,7 +127,7 @@
- /*
-  * Number of elements in the structure unique_id_rec.
-  */
--#define UNIQUE_ID_REC_MAX 5
-+#define UNIQUE_ID_REC_MAX 4
- 
- static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX],
-                       unique_id_rec_size[UNIQUE_ID_REC_MAX],
-@@ -138,113 +136,32 @@
- 
- static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server)
- {
--    char str[APRMAXHOSTLEN + 1];
--    apr_status_t rv;
--    char *ipaddrstr;
--    apr_sockaddr_t *sockaddr;
--
-     /*
-      * Calculate the sizes and offsets in cur_unique_id.
-      */
-     unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp);
-     unique_id_rec_size[0] = sizeof(cur_unique_id.stamp);
--    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr);
--    unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr);
--    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid);
--    unique_id_rec_size[2] = sizeof(cur_unique_id.pid);
--    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter);
--    unique_id_rec_size[3] = sizeof(cur_unique_id.counter);
--    unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index);
--    unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index);
-+    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root);
-+    unique_id_rec_size[1] = sizeof(cur_unique_id.root);
-+    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter);
-+    unique_id_rec_size[2] = sizeof(cur_unique_id.counter);
-+    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index);
-+    unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index);
-     unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] +
--                               unique_id_rec_size[2] + unique_id_rec_size[3] +
--                               unique_id_rec_size[4];
-+                               unique_id_rec_size[2] + unique_id_rec_size[3];
- 
-     /*
-      * Calculate the size of the structure when encoded.
-      */
-     unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6;
- 
--    /*
--     * Now get the global in_addr.  Note that it is not sufficient to use one
--     * of the addresses from the main_server, since those aren't as likely to
--     * be unique as the physical address of the machine
--     */
--    if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563)
--          "unable to find hostname of the server");
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) {
--        global_in_addr = sockaddr->sa.sin.sin_addr.s_addr;
--    }
--    else {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564)
--                    "unable to find IPv4 address of \"%s\"", str);
--#if APR_HAVE_IPV6
--        if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) {
--            memcpy(&global_in_addr,
--                   (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr),
--                   sizeof(global_in_addr));
--            ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565)
--                         "using low-order bits of IPv6 address "
--                         "as if they were unique");
--        }
--        else
--#endif
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    apr_sockaddr_ip_get(&ipaddrstr, sockaddr);
--    ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s",
--                 ipaddrstr);
--
--    /*
--     * If the server is pummelled with restart requests we could possibly end
--     * up in a situation where we're starting again during the same second
--     * that has been used in previous identifiers.  Avoid that situation.
--     *
--     * In truth, for this to actually happen not only would it have to restart
--     * in the same second, but it would have to somehow get the same pids as
--     * one of the other servers that was running in that second. Which would
--     * mean a 64k wraparound on pids ... not very likely at all.
--     *
--     * But protecting against it is relatively cheap.  We just sleep into the
--     * next second.
--     */
--    apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now()));
-     return OK;
- }
- 
- static void unique_id_child_init(apr_pool_t *p, server_rec *s)
- {
--    pid_t pid;
--
--    /*
--     * Note that we use the pid because it's possible that on the same
--     * physical machine there are multiple servers (i.e. using Listen). But
--     * it's guaranteed that none of them will share the same pids between
--     * children.
--     *
--     * XXX: for multithread this needs to use a pid/tid combo and probably
--     * needs to be expanded to 32 bits
--     */
--    pid = getpid();
--    cur_unique_id.pid = pid;
--
--    /*
--     * Test our assumption that the pid is 32-bits.  It's possible that
--     * 64-bit machines will declare pid_t to be 64 bits but only use 32
--     * of them.  It would have been really nice to test this during
--     * global_init ... but oh well.
--     */
--    if ((pid_t)cur_unique_id.pid != pid) {
--        ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, APLOGNO(01567)
--                    "oh no! pids are greater than 32-bits!  I'm broken!");
--    }
--
--    cur_unique_id.in_addr = global_in_addr;
-+    ap_random_insecure_bytes(&cur_unique_id.root,
-+                             sizeof(cur_unique_id.root));
- 
-     /*
-      * If we use 0 as the initial counter we have a little less protection
-@@ -253,13 +170,6 @@
-      */
-     ap_random_insecure_bytes(&cur_unique_id.counter,
-                              sizeof(cur_unique_id.counter));
--
--    /*
--     * We must always use network ordering for these bytes, so that
--     * identifiers are comparable between machines of different byte
--     * orderings.  Note in_addr is already in network order.
--     */
--    cur_unique_id.pid = htonl(cur_unique_id.pid);
- }
- 
- /* NOTE: This is *NOT* the same encoding used by base64encode ... the last two
-@@ -291,10 +201,8 @@
-     unsigned short counter;
-     int i,j,k;
- 
--    new_unique_id.in_addr = cur_unique_id.in_addr;
--    new_unique_id.pid = cur_unique_id.pid;
-+    memcpy(&new_unique_id.root, &cur_unique_id.root, ROOT_SIZE);
-     new_unique_id.counter = cur_unique_id.counter;
--
-     new_unique_id.stamp = htonl((unsigned int)apr_time_sec(r->request_time));
-     new_unique_id.thread_index = htonl((unsigned int)r->connection->id);
- 
diff --git a/httpd.service b/httpd.service
index 1f707e8..1b779e9 100644
--- a/httpd.service
+++ b/httpd.service
@@ -1,9 +1,8 @@
 # See httpd.service(8) for more information on using the httpd service.
 
 # Modifying this file in-place is not recommended, because changes
-# will be overwritten during package upgrades.  If you want to
-# customize the behaviour, the best way is to use "systemctl edit"
-# command to create an override unit.
+# will be overwritten during package upgrades.  To customize the
+# behaviour, run "systemctl edit httpd" to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by
diff --git a/httpd.service.xml b/httpd.service.xml
index d03e133..8f82e59 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -143,6 +143,11 @@ Wants=network-online.target</programlisting>
       which terminates the server only once active connections have
       been processed.</para>
 
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
     <refsect2>
diff --git a/httpd.spec b/httpd.spec
index 81f556e..1b186ae 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,10 +7,10 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.27
-Release: 2%{?dist}
-URL: http://httpd.apache.org/
-Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
+Version: 2.4.33
+Release: 4%{?dist}
+URL: https://httpd.apache.org/
+Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
 Source4: httpd-ssl-pass-dialog
@@ -37,6 +37,7 @@ Source25: 01-session.conf
 Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
+Source29: 01-md.conf
 # Documentation
 Source30: README.confd
 Source31: README.confmod
@@ -52,21 +53,24 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch23: httpd-2.4.4-export.patch
+Patch21: httpd-2.4.33-mddefault.patch
+Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.10-mod_systemd.patch
+Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch35: httpd-2.4.17-sslciphdefault.patch
+Patch35: httpd-2.4.33-sslciphdefault.patch
+
 # Bug fixes
-Patch56: httpd-2.4.4-mod_unique_id.patch
-Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.25-r1738878.patch
+Patch58: httpd-2.4.33-r1738878.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+Patch59: httpd-2.4.33-sslmerging.patch
+
 # Security fixes
 
 License: ASL 2.0
@@ -158,6 +162,19 @@ The mod_ssl module provides strong cryptography for the Apache Web
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
+%package -n mod_md
+Group: System Environment/Daemons
+Summary: Certificate provisioning using ACME for the Apache HTTP Server
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+BuildRequires: jansson-devel, libcurl-devel
+
+%description -n mod_md
+This module manages common properties of domains for one or more
+virtual hosts. Specifically it can use the ACME protocol (RFC Draft)
+to automate certificate provisioning. These will be configured for
+managed domains and their virtual hosts automatically. This includes
+renewal of certificates before they expire.
+
 %package -n mod_proxy_html
 Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
@@ -199,6 +216,7 @@ interface for storing and accessing per-user session data.
 
 %patch19 -p1 -b .detectsystemd
 
+%patch21 -p1 -b .mddefault
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -206,13 +224,12 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
-%patch56 -p1 -b .uniqueid
-%patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .sslmerging
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -309,7 +326,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
+         01-md.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -352,6 +370,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
 
 # Other directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
+         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
@@ -411,6 +430,7 @@ ln -s ../../pixmaps/poweredby.png \
 
 # symlinks for /etc/httpd
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
+ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state
 ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run
 ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 
@@ -567,6 +587,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
+%{_sysconfdir}/httpd/state
 %{_sysconfdir}/httpd/run
 %dir %{_sysconfdir}/httpd/conf
 %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf
@@ -585,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
 
 %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean
 %ghost %{_sysconfdir}/sysconfig/httpd
@@ -604,6 +626,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/httpd/modules/mod*.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
+%exclude %{_libdir}/httpd/modules/mod_md.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
@@ -622,6 +645,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0700,apache,apache) %dir /run/httpd/htcacheclean
 %attr(0700,root,root) %dir %{_localstatedir}/log/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav
+%attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
@@ -629,8 +653,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_unitdir}/*.service
 %{_unitdir}/*.socket
-%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
-%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files filesystem
 %dir %{_sysconfdir}/httpd
@@ -641,6 +663,8 @@ rm -rf $RPM_BUILD_ROOT
 %dir %{docroot}/html
 %dir %{contentdir}
 %dir %{contentdir}/icons
+%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
+%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files tools
 %defattr(-,root,root)
@@ -681,6 +705,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
+%files -n mod_md
+%defattr(-,root,root)
+%{_libdir}/httpd/modules/mod_md.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
+
 %files devel
 %defattr(-,root,root)
 %{_includedir}/httpd
@@ -692,6 +721,36 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
+- mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
+
+* Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
+- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
+
+* Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
+- Exclude mod_md config file from main package (#1562413)
+
+* Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
+- rebase to 2.4.33 (#1560174)
+- add mod_md subpackage; load mod_proxy_uwsgi by default
+
+* Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
+- new version 2.4.29
+
+* Tue Oct 10 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
+- new version 2.4.28
+
+* Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.27-8
+- Backport patch for fixing ticket key usage
+
+* Mon Oct  9 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
+- move httpd.service.d, httpd.socket.d dirs to -filesystem
+- add new content-length filter (upstream PR 61222)
+- update mod_systemd (r1802251)
+
+* Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
+- Address CVE-2017-9798 by applying patch from upstream (#1490344)
+
 * Wed Jul 12 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-2
 - Resolves: #1469959 - httpd update cleaned out /etc/sysconfig
 
diff --git a/index.html b/index.html
index 7eff881..1b7ea03 100644
--- a/index.html
+++ b/index.html
@@ -111,7 +111,7 @@
 					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
 					</ul>
 
-					<p>For more information about Fedora, please visit the <a href="http://fedoraproject.org/">Fedora Project website</a>.</p>
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
 					<hr />
 				</div>
 
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="http://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>
diff --git a/pullrev.sh b/pullrev.sh
index d106968..c366613 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.26
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.27
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"
diff --git a/sources b/sources
index dafe33c..e8c3a89 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.27.tar.bz2) = 7e7e8070715b74cb6890096a74e194f4c6a49c14bda685b1ad832e84312f1ac4316ea03a430e679502bfd8e1853aefa544ee002a20d0f7e994b9a590c74bc42c
+SHA512 (httpd-2.4.33.tar.bz2) = e74b2b3346d67be45a8bc8a7cbb8eabf5c403a5cfe5797a976f94a539529843fbcdf03b9ca0548816b2cf37f4ce0eb301f8d5af25b1270fdf8dd9f5bf0585269