diff --git a/.gitignore b/.gitignore
index 8df7f18..5bb7aaa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,7 +52,3 @@ x86_64
 /httpd-2.4.59.tar.bz2.asc
 /httpd-2.4.61.tar.bz2.asc
 /httpd-2.4.62.tar.bz2.asc
-/httpd-2.4.63.tar.bz2.asc
-/httpd-2.4.64.tar.bz2.asc
-/httpd-2.4.65.tar.bz2.asc
-/httpd-2.4.66.tar.bz2.asc
diff --git a/httpd-2.4.64-mod_systemd.patch b/httpd-2.4.43-mod_systemd.patch
similarity index 78%
rename from httpd-2.4.64-mod_systemd.patch
rename to httpd-2.4.43-mod_systemd.patch
index cad4a01..8d7922e 100644
--- a/httpd-2.4.64-mod_systemd.patch
+++ b/httpd-2.4.43-mod_systemd.patch
@@ -1,12 +1,10 @@
 
 More verbose startup logging for mod_systemd.
 
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index 22482fd..b46d3ef 100644
---- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -34,11 +34,14 @@
- #endif
+--- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd
++++ httpd-2.4.43/modules/arch/unix/mod_systemd.c
+@@ -29,11 +29,14 @@
+ #include "mpm_common.h"
  
  #include "systemd/sd-daemon.h"
 +#include "systemd/sd-journal.h"
@@ -20,9 +18,9 @@ index 22482fd..b46d3ef 100644
  static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
                                apr_pool_t *ptemp)
  {
-@@ -63,6 +66,20 @@ static void log_selinux_context(void)
+@@ -44,6 +47,20 @@
+     return OK;
  }
- #endif
  
 +static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
 +{
@@ -41,17 +39,21 @@ index 22482fd..b46d3ef 100644
  /* Report the service is ready in post_config, which could be during
   * startup or after a reload.  The server could still hit a fatal
   * startup error after this point during ap_run_mpm(), so this is
-@@ -73,23 +90,52 @@ static void log_selinux_context(void)
- static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -51,19 +68,51 @@
+  * the TCP ports so new connections will not be rejected.  There will
+  * always be a possible async failure event simultaneous to the
+  * service reporting "ready", so this should be good enough. */
+-static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog,
++static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
                                 apr_pool_t *ptemp, server_rec *main_server)
  {
 +    ap_listen_rec *lr;
 +    apr_size_t plen = sizeof describe_listeners;
 +    char *p = describe_listeners;
 +
-     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-         return OK;
- 
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
 +    for (lr = ap_listeners; lr; lr = lr->next) {
 +        char *s = dump_listener(lr, ptemp);
 +
@@ -72,10 +74,6 @@ index 22482fd..b46d3ef 100644
 +        }
 +    }
 +
- #ifdef HAVE_SELINUX
-     log_selinux_context();
- #endif
- 
      sd_notify(0, "READY=1\n"
                "STATUS=Configuration loaded.\n");
 +
diff --git a/httpd-2.4.43-socket-activation.patch b/httpd-2.4.43-socket-activation.patch
new file mode 100644
index 0000000..77eaa45
--- /dev/null
+++ b/httpd-2.4.43-socket-activation.patch
@@ -0,0 +1,300 @@
+diff --git a/server/listen.c b/server/listen.c
+index 9577d60..d718db1 100644
+--- a/server/listen.c
++++ b/server/listen.c
+@@ -35,6 +35,10 @@
+ #include <unistd.h>
+ #endif
+ 
++#ifdef HAVE_SYSTEMD
++#include <systemd/sd-daemon.h>
++#endif
++
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -60,9 +64,12 @@ static int ap_listenbacklog;
+ static int ap_listencbratio;
+ static int send_buffer_size;
+ static int receive_buffer_size;
++#ifdef HAVE_SYSTEMD
++static int use_systemd = -1;
++#endif
+ 
+ /* TODO: make_sock is just begging and screaming for APR abstraction */
+-static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
++static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen)
+ {
+     apr_socket_t *s = server->sd;
+     int one = 1;
+@@ -95,20 +102,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+         return stat;
+     }
+ 
+-#if APR_HAVE_IPV6
+-    if (server->bind_addr->family == APR_INET6) {
+-        stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
+-        if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
+-            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
+-                          "make_sock: for address %pI, apr_socket_opt_set: "
+-                          "(IPV6_V6ONLY)",
+-                          server->bind_addr);
+-            apr_socket_close(s);
+-            return stat;
+-        }
+-    }
+-#endif
+-
+     /*
+      * To send data over high bandwidth-delay connections at full
+      * speed we must force the TCP window to open wide enough to keep the
+@@ -170,21 +163,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+     }
+ #endif
+ 
+-    if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
+-                      "make_sock: could not bind to address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
+-    }
++    if (do_bind_listen) {
++#if APR_HAVE_IPV6
++        if (server->bind_addr->family == APR_INET6) {
++            stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
++            if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
++                ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
++                              "make_sock: for address %pI, apr_socket_opt_set: "
++                              "(IPV6_V6ONLY)",
++                              server->bind_addr);
++                apr_socket_close(s);
++                return stat;
++            }
++        }
++#endif
+ 
+-    if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
+-                      "make_sock: unable to listen for connections "
+-                      "on address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
++        if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
++            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
++                          "make_sock: could not bind to address %pI",
++                          server->bind_addr);
++            apr_socket_close(s);
++            return stat;
++        }
++
++        if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
++            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
++                          "make_sock: unable to listen for connections "
++                          "on address %pI",
++                          server->bind_addr);
++            apr_socket_close(s);
++            return stat;
++        }
+     }
+ 
+ #ifdef WIN32
+@@ -335,6 +344,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
+ }
+ 
++#ifdef HAVE_SYSTEMD
++
++static int find_systemd_socket(process_rec * process, apr_port_t port) {
++    int fdcount, fd;
++    int sdc = sd_listen_fds(0);
++
++    if (sdc < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
++                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
++                      sdc);
++        return -1;
++    }
++
++    if (sdc == 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
++                      "find_systemd_socket: At least one socket must be set.");
++        return -1;
++    }
++
++    fdcount = atoi(getenv("LISTEN_FDS"));
++    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
++        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
++            return fd;
++        }
++    }
++
++    return -1;
++}
++
++static apr_status_t alloc_systemd_listener(process_rec * process,
++                                           int fd, const char *proto,
++                                           ap_listen_rec **out_rec)
++{
++    apr_status_t rv;
++    struct sockaddr sa;
++    socklen_t len = sizeof(struct sockaddr);
++    apr_os_sock_info_t si;
++    ap_listen_rec *rec;
++    *out_rec = NULL;
++
++    memset(&si, 0, sizeof(si));
++
++    rv = getsockname(fd, &sa, &len);
++
++    if (rv != 0) {
++        rv = apr_get_netos_error();
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489)
++                      "getsockname on %d failed.", fd);
++        return rv;
++    }
++
++    si.os_sock = &fd;
++    si.family = sa.sa_family;
++    si.local = &sa;
++    si.type = SOCK_STREAM;
++    si.protocol = APR_PROTO_TCP;
++
++    rec = apr_palloc(process->pool, sizeof(ap_listen_rec));
++    rec->active = 0;
++    rec->next = 0;
++
++
++    rv = apr_os_sock_make(&rec->sd, &si, process->pool);
++    if (rv != APR_SUCCESS) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490)
++                      "apr_os_sock_make on %d failed.", fd);
++        return rv;
++    }
++
++    rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd);
++    if (rv != APR_SUCCESS) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491)
++                      "apr_socket_addr_get on %d failed.", fd);
++        return rv;
++    }
++
++    rec->protocol = apr_pstrdup(process->pool, proto);
++
++    *out_rec = rec;
++
++    return make_sock(process->pool, rec, 0);
++}
++
++static const char *set_systemd_listener(process_rec *process, apr_port_t port,
++                                        const char *proto)
++{
++    ap_listen_rec *last, *new;
++    apr_status_t rv;
++    int fd = find_systemd_socket(process, port);
++    if (fd < 0) {
++        return "Systemd socket activation is used, but this port is not "
++                "configured in systemd";
++    }
++
++    last = ap_listeners;
++    while (last && last->next) {
++        last = last->next;
++    }
++
++    rv = alloc_systemd_listener(process, fd, proto, &new);
++    if (rv != APR_SUCCESS) {
++        return "Failed to setup socket passed by systemd using socket activation";
++    }
++
++    if (last == NULL) {
++        ap_listeners = last = new;
++    }
++    else {
++        last->next = new;
++        last = new;
++    }
++
++    return NULL;
++}
++
++#endif /* HAVE_SYSTEMD */
++
+ static const char *alloc_listener(process_rec *process, const char *addr,
+                                   apr_port_t port, const char* proto,
+                                   const char *scope_id, void *slave,
+@@ -529,7 +655,7 @@ static int open_listeners(apr_pool_t *pool)
+                 }
+             }
+ #endif
+-            if (make_sock(pool, lr) == APR_SUCCESS) {
++            if (make_sock(pool, lr, 1) == APR_SUCCESS) {
+                 ++num_open;
+             }
+             else {
+@@ -641,8 +767,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+         }
+     }
+ 
+-    if (open_listeners(s->process->pool)) {
+-        return 0;
++#ifdef HAVE_SYSTEMD
++    if (use_systemd) {
++        const char *userdata_key = "ap_open_systemd_listeners";
++        void *data;
++        /* clear the enviroment on our second run
++        * so that none of our future children get confused.
++        */
++        apr_pool_userdata_get(&data, userdata_key, s->process->pool);
++        if (!data) {
++            apr_pool_userdata_set((const void *)1, userdata_key,
++                                apr_pool_cleanup_null, s->process->pool);
++        }
++        else {
++            sd_listen_fds(1);
++        }
++    }
++    else
++#endif
++    {
++        if (open_listeners(s->process->pool)) {
++            return 0;
++        }
+     }
+ 
+     for (lr = ap_listeners; lr; lr = lr->next) {
+@@ -732,7 +878,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+                             duplr->bind_addr);
+                 return stat;
+             }
+-            make_sock(p, duplr);
++            make_sock(p, duplr, 1);
+ #if AP_NONBLOCK_WHEN_MULTI_LISTEN
+             use_nonblock = (ap_listeners && ap_listeners->next);
+             stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
+@@ -859,6 +1005,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     if (argc < 1 || argc > 2) {
+         return "Listen requires 1 or 2 arguments.";
+     }
++#ifdef HAVE_SYSTEMD
++    if (use_systemd == -1) {
++        use_systemd = sd_listen_fds(0) > 0;
++    }
++#endif
+ 
+     rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
+     if (rv != APR_SUCCESS) {
+@@ -894,6 +1045,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+         ap_str_tolower(proto);
+     }
+ 
++#ifdef HAVE_SYSTEMD
++    if (use_systemd) {
++        return set_systemd_listener(cmd->server->process, port, proto);
++    }
++#endif
++
+     return alloc_listener(cmd->server->process, host, port, proto,
+                           scope_id, NULL, cmd->temp_pool);
+ }
diff --git a/httpd-2.4.64-sslprotdefault.patch b/httpd-2.4.43-sslprotdefault.patch
similarity index 84%
rename from httpd-2.4.64-sslprotdefault.patch
rename to httpd-2.4.43-sslprotdefault.patch
index 6d97935..d089823 100644
--- a/httpd-2.4.64-sslprotdefault.patch
+++ b/httpd-2.4.43-sslprotdefault.patch
@@ -1,8 +1,8 @@
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 8fae1f8..c5dce7f 100644
+index 27e7a53..b53f3f8 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
-@@ -127,7 +127,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
      mctx->ticket_key          = NULL;
  #endif
  
@@ -11,7 +11,7 @@ index 8fae1f8..c5dce7f 100644
      mctx->protocol_set        = 0;
  
      mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
-@@ -268,6 +268,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
      if (add->protocol_set) {
          mrg->protocol_set = 1;
          mrg->protocol = add->protocol;
@@ -19,19 +19,20 @@ index 8fae1f8..c5dce7f 100644
      }
      else {
          mrg->protocol_set = base->protocol_set;
+
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 4e265b3..2fbd076 100644
+index bfad47a..b0fcf81 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -638,6 +638,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
      char *cp;
      int protocol = mctx->protocol;
 +    int protocol_set = mctx->protocol_set;
      SSLSrvConfigRec *sc = mySrvConfig(s);
  #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-     /* default is highest supported version, will be overridden below */
-@@ -652,12 +653,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     int prot;
+@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
       *  Create the new per-server SSL context
       */
      if (protocol == SSL_PROTOCOL_NONE) {
@@ -55,7 +56,7 @@ index 4e265b3..2fbd076 100644
  #ifndef OPENSSL_NO_SSL3
                       (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
  #endif
-@@ -670,7 +677,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
  #endif
  #endif
                       NULL);
@@ -65,7 +66,7 @@ index 4e265b3..2fbd076 100644
  
      ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
                   "Creating new SSL context (protocols: %s)", cp);
-@@ -776,13 +784,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
  #endif
      } else {
@@ -87,7 +88,7 @@ index 4e265b3..2fbd076 100644
  
      /* Next we scan for the minimal protocol version we should provide,
       * but we do not allow holes between max and min */
-@@ -806,7 +816,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
      }
  #endif
diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
new file mode 100644
index 0000000..8db5c57
--- /dev/null
+++ b/httpd-2.4.53-separate-systemd-fns.patch
@@ -0,0 +1,286 @@
+diff --git a/acinclude.m4 b/acinclude.m4
+index 05abe18..97484c9 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -631,7 +631,6 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
+-        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
+diff --git a/include/ap_listen.h b/include/ap_listen.h
+index 58c2574..d5ed968 100644
+--- a/include/ap_listen.h
++++ b/include/ap_listen.h
+@@ -29,6 +29,7 @@
+ #include "apr_network_io.h"
+ #include "httpd.h"
+ #include "http_config.h"
++#include "apr_optional.h"
+ 
+ #ifdef __cplusplus
+ extern "C" {
+@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd,
+                                                            void *dummy,
+                                                            const char *arg);
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
++#endif
++
++
+ #define LISTEN_COMMANDS \
+ AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \
+   "Maximum length of the queue of pending connections, as used by listen(2)"), \
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index eda1272..fc059fc 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -35,6 +35,15 @@
+ #include <unistd.h>
+ #endif
+ 
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_journal_stream_fd, (const char *, int, int));
++
+ static char describe_listeners[30];
+ 
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s)
+     return DECLINED;
+ }
+ 
++static int ap_find_systemd_socket(process_rec * process, apr_port_t port) {
++    int fdcount, fd;
++    int sdc = sd_listen_fds(0);
++
++    if (sdc < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
++                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
++                      sdc);
++        return -1;
++    }
++
++    if (sdc == 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
++                      "find_systemd_socket: At least one socket must be set.");
++        return -1;
++    }
++
++    fdcount = atoi(getenv("LISTEN_FDS"));
++    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
++        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
++            return fd;
++        }
++    }
++
++    return -1;
++}
++
++static int ap_systemd_listen_fds(int unset_environment){
++    return sd_listen_fds(unset_environment);
++}
++
++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
++    return sd_journal_stream_fd("httpd", priority, 0);
++}
++
+ static void systemd_register_hooks(apr_pool_t *p)
+ {
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
++    APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++
+     /* Enable ap_extended_status. */
+     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
+     /* Signal service is ready. */
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 0848d2e..8af2299 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
+-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
+ 
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 0b11f60..c3f0a51 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,10 +172,6 @@
+ #include <limits.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-journal.h>
+-#endif
+-
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
+ {
+ #ifdef HAVE_SYSTEMD
+     int fd;
++    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
++    
++    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++    if (systemd_journal_stream_fd == NULL) {
++        return APR_ENOTIMPL;
++    }
+ 
+-    fd = sd_journal_stream_fd("httpd", priority, 0);
++    fd = systemd_journal_stream_fd("httpd", priority, 0);
++    
+     if (fd < 0) return fd;
+ 
+     /* This is an AF_UNIX socket fd so is more pipe-like than
+diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
+index 877a593..bd52a98 100644
+--- a/modules/loggers/mod_log_config.h
++++ b/modules/loggers/mod_log_config.h
+@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
+  */
+ APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
++#endif
++
+ #endif /* MOD_LOG_CONFIG */
+ /** @} */
+ 
+diff --git a/server/listen.c b/server/listen.c
+index d718db1..2a4e87a 100644
+--- a/server/listen.c
++++ b/server/listen.c
+@@ -35,10 +35,6 @@
+ #include <unistd.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-daemon.h>
+-#endif
+-
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -345,34 +341,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+ }
+ 
+ #ifdef HAVE_SYSTEMD
+-
+-static int find_systemd_socket(process_rec * process, apr_port_t port) {
+-    int fdcount, fd;
+-    int sdc = sd_listen_fds(0);
+-
+-    if (sdc < 0) {
+-        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
+-                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
+-                      sdc);
+-        return -1;
+-    }
+-
+-    if (sdc == 0) {
+-        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
+-                      "find_systemd_socket: At least one socket must be set.");
+-        return -1;
+-    }
+-
+-    fdcount = atoi(getenv("LISTEN_FDS"));
+-    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
+-        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
+-            return fd;
+-        }
+-    }
+-
+-    return -1;
+-}
+-
+ static apr_status_t alloc_systemd_listener(process_rec * process,
+                                            int fd, const char *proto,
+                                            ap_listen_rec **out_rec)
+@@ -432,6 +400,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+ {
+     ap_listen_rec *last, *new;
+     apr_status_t rv;
++    APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket;
++
++    find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket);
++
++    if (!find_systemd_socket)
++       return "Systemd socket activation is used, but mod_systemd is probably "
++               "not loaded";
++
+     int fd = find_systemd_socket(process, port);
+     if (fd < 0) {
+         return "Systemd socket activation is used, but this port is not "
+@@ -458,7 +434,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+ 
+     return NULL;
+ }
+-
+ #endif /* HAVE_SYSTEMD */
+ 
+ static const char *alloc_listener(process_rec *process, const char *addr,
+@@ -741,6 +716,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+     int num_listeners = 0;
+     const char* proto;
+     int found;
++#ifdef HAVE_SYSTEMD
++    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
++#endif
+ 
+     for (ls = s; ls; ls = ls->next) {
+         proto = ap_get_server_protocol(ls);
+@@ -780,7 +758,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+                                 apr_pool_cleanup_null, s->process->pool);
+         }
+         else {
+-            sd_listen_fds(1);
++            systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
++            if (systemd_listen_fds != NULL) {
++                systemd_listen_fds(1);
++            }
+         }
+     }
+     else
+@@ -997,6 +978,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     apr_port_t port;
+     apr_status_t rv;
+     const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++#ifdef HAVE_SYSTEMD
++    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
++#endif
+ 
+     if (err != NULL) {
+         return err;
+@@ -1007,7 +991,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     }
+ #ifdef HAVE_SYSTEMD
+     if (use_systemd == -1) {
+-        use_systemd = sd_listen_fds(0) > 0;
++        systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
++        if (systemd_listen_fds != NULL) {
++            use_systemd = systemd_listen_fds(0) > 0;
++        } else {
++            use_systemd = 0;
++        }
+     }
+ #endif
+ 
diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch
new file mode 100644
index 0000000..661b983
--- /dev/null
+++ b/httpd-2.4.54-selinux.patch
@@ -0,0 +1,64 @@
+
+Upstream-Status: in trunk not in 2.4.x
+
+diff --git a/configure.in b/configure.in
+index 74015ca..8c0ee10 100644
+--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux
++++ httpd-2.4.54/modules/arch/unix/config5.m4
+@@ -23,6 +23,11 @@
+     AC_MSG_WARN([Your system does not support systemd.])
+     enable_systemd="no"
+   else
++    AC_CHECK_LIB(selinux, is_selinux_enabled, [
++      AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
++      APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux])
++    ])
++  
+     APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
+   fi
+ ])
+--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux
++++ httpd-2.4.54/modules/arch/unix/mod_systemd.c
+@@ -35,6 +35,10 @@
+ #include <unistd.h>
+ #endif
+ 
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
+ APR_DECLARE_OPTIONAL_FN(int,
+                         ap_find_systemd_socket, (process_rec *, apr_port_t));
+ 
+@@ -70,6 +74,20 @@
+     return apr_psprintf(p, "%s port %u", addr, sa->port);
+ }
+ 
++#ifdef HAVE_SELINUX
++static void log_selinux_context(void)
++{
++    char *con;
++
++    if (is_selinux_enabled() && getcon(&con) == 0) {
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
++                     "SELinux policy enabled; "
++                     "httpd running as context %s", con);
++        freecon(con);
++    }
++}
++#endif
++
+ /* Report the service is ready in post_config, which could be during
+  * startup or after a reload.  The server could still hit a fatal
+  * startup error after this point during ap_run_mpm(), so this is
+@@ -87,6 +105,10 @@
+     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+         return OK;
+ 
++#ifdef HAVE_SELINUX
++    log_selinux_context();
++#endif
++    
+     for (lr = ap_listeners; lr; lr = lr->next) {
+         char *s = dump_listener(lr, ptemp);
+ 
diff --git a/httpd-2.4.63-r1912477+.patch b/httpd-2.4.58-r1912477+.patch
similarity index 85%
rename from httpd-2.4.63-r1912477+.patch
rename to httpd-2.4.58-r1912477+.patch
index 35e5866..eb3deff 100644
--- a/httpd-2.4.63-r1912477+.patch
+++ b/httpd-2.4.58-r1912477+.patch
@@ -7,11 +7,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1914438
 
 Upstream-Status: in trunk, not proposed for 2.4.x
 
-diff --git a/modules/dav/fs/config6.m4 b/modules/dav/fs/config6.m4
-index dd26ec8..72fff9a 100644
---- a/modules/dav/fs/config6.m4
-+++ b/modules/dav/fs/config6.m4
-@@ -20,4 +20,10 @@ esac
+--- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+
++++ httpd-2.4.58/modules/dav/fs/config6.m4
+@@ -20,4 +20,10 @@
  
  APACHE_MODULE(dav_fs, DAV provider for the filesystem.  --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav)
  
@@ -22,10 +20,8 @@ index dd26ec8..72fff9a 100644
 +fi
 +
  APACHE_MODPATH_FINISH
-diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c
-index 39ab4ad..4551f70 100644
---- a/modules/dav/fs/dbm.c
-+++ b/modules/dav/fs/dbm.c
+--- httpd-2.4.58/modules/dav/fs/dbm.c.r1912477+
++++ httpd-2.4.58/modules/dav/fs/dbm.c
 @@ -47,6 +47,10 @@
  #include "http_log.h"
  #include "http_main.h"      /* for ap_server_conf */
@@ -37,7 +33,16 @@ index 39ab4ad..4551f70 100644
  APLOG_USE_MODULE(dav_fs);
  
  struct dav_db {
-@@ -129,10 +133,10 @@ void dav_fs_ensure_state_dir(apr_pool_t * p, const char *dirname)
+@@ -100,7 +104,7 @@
+     /* There might not be a <db> if we had problems creating it. */
+     if (db == NULL) {
+         errcode = 1;
+-        errstr = "Could not open property database.";
++        errstr = "Could not open database.";
+         if (APR_STATUS_IS_EDSOOPEN(status))
+             ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576)
+             "The DBM driver could not be loaded");
+@@ -129,10 +133,10 @@
  /* dav_dbm_open_direct:  Opens a *dbm database specified by path.
   *    ro = boolean read-only flag.
   */
@@ -51,7 +56,7 @@ index 39ab4ad..4551f70 100644
      const apr_dbm_driver_t *driver;
      const apu_err_t *err;
  #endif
-@@ -141,11 +145,12 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+@@ -141,13 +145,13 @@
  
      *pdb = NULL;
  
@@ -59,16 +64,18 @@ index 39ab4ad..4551f70 100644
 -    if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) {
 +#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
 +    if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) {
-+
          ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289)
 -                     "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
 -                             err->reason, err->msg);
 +                     "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s",
 +                     err->reason, dbmtype, err->msg);
          return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
-                 "Could not load library for database.");
+-                "Could not load library for property database.");
++                "Could not load library for database.");
      }
-@@ -156,7 +161,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+     if ((status = apr_dbm_open2(&file, driver, pathname,
+                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
+@@ -156,7 +160,7 @@
          return dav_fs_dbm_error(NULL, p, status);
      }
  #else
@@ -77,7 +84,7 @@ index 39ab4ad..4551f70 100644
                                 ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
                                 APR_OS_DEFAULT, p))
                  != APR_SUCCESS
-@@ -206,7 +211,7 @@ static dav_error * dav_dbm_open(apr_pool_t * p, const dav_resource *resource,
+@@ -206,7 +210,7 @@
  
      /* ### do we need to deal with the umask? */
  
@@ -86,11 +93,9 @@ index 39ab4ad..4551f70 100644
  }
  
  void dav_dbm_close(dav_db *db)
-diff --git a/modules/dav/fs/lock.c b/modules/dav/fs/lock.c
-index ef18c4a..29d167d 100644
---- a/modules/dav/fs/lock.c
-+++ b/modules/dav/fs/lock.c
-@@ -181,8 +181,7 @@ struct dav_lockdb_private
+--- httpd-2.4.58/modules/dav/fs/lock.c.r1912477+
++++ httpd-2.4.58/modules/dav/fs/lock.c
+@@ -181,8 +181,7 @@
  {
      request_rec *r;                  /* for accessing the uuid state */
      apr_pool_t *pool;                /* a pool to use */
@@ -100,7 +105,7 @@ index ef18c4a..29d167d 100644
      int opened;                      /* we opened the database */
      dav_db *db;                      /* if non-NULL, the lock database */
  };
-@@ -292,6 +291,19 @@ static int dav_fs_compare_locktoken(
+@@ -292,6 +291,19 @@
      return dav_compare_locktoken(lt1, lt2);
  }
  
@@ -120,7 +125,7 @@ index ef18c4a..29d167d 100644
  /*
  ** dav_fs_really_open_lockdb:
  **
-@@ -300,15 +312,27 @@ static int dav_fs_compare_locktoken(
+@@ -300,15 +312,27 @@
  static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
  {
      dav_error *err;
@@ -149,7 +154,7 @@ index ef18c4a..29d167d 100644
          return dav_push_error(lockdb->info->pool,
                                HTTP_INTERNAL_SERVER_ERROR,
                                DAV_ERR_LOCK_OPENDB,
-@@ -316,6 +340,10 @@ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
+@@ -316,6 +340,10 @@
                                err);
      }
  
@@ -160,7 +165,7 @@ index ef18c4a..29d167d 100644
      /* all right. it is opened now. */
      lockdb->info->opened = 1;
  
-@@ -341,9 +369,9 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
+@@ -341,9 +369,9 @@
      comb->pub.info = &comb->priv;
      comb->priv.r = r;
      comb->priv.pool = r->pool;
@@ -173,7 +178,7 @@ index ef18c4a..29d167d 100644
          return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
                               DAV_ERR_LOCK_NO_DB, 0,
                               "A lock database was not specified with the "
-@@ -369,8 +397,8 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
+@@ -369,8 +397,8 @@
  */
  static void dav_fs_close_lockdb(dav_lockdb *lockdb)
  {
@@ -184,10 +189,8 @@ index ef18c4a..29d167d 100644
  }
  
  /*
-diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
-index 2389f8f..4bf6c51 100644
---- a/modules/dav/fs/mod_dav_fs.c
-+++ b/modules/dav/fs/mod_dav_fs.c
+--- httpd-2.4.58/modules/dav/fs/mod_dav_fs.c.r1912477+
++++ httpd-2.4.58/modules/dav/fs/mod_dav_fs.c
 @@ -14,31 +14,35 @@
   * limitations under the License.
   */
@@ -235,7 +238,7 @@ index 2389f8f..4bf6c51 100644
  }
  
  static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
-@@ -57,15 +61,50 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
+@@ -57,15 +61,50 @@
  
      newconf->lockdb_path =
          child->lockdb_path ? child->lockdb_path : parent->lockdb_path;
@@ -269,9 +272,8 @@ index 2389f8f..4bf6c51 100644
                                         apr_pool_t *ptemp, server_rec *base_server)
  {
      server_rec *s;
--
 +    apr_status_t rv;
-+
+ 
 +    /* Ignore first pass through the config. */
 +    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
 +        return OK;
@@ -287,7 +289,7 @@ index 2389f8f..4bf6c51 100644
      for (s = base_server; s; s = s->next) {
          dav_fs_server_conf *conf;
  
-@@ -74,6 +113,13 @@ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
+@@ -74,6 +113,13 @@
          if (!conf->lockdb_path) {
              conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
          }
@@ -301,7 +303,7 @@ index 2389f8f..4bf6c51 100644
      }
  
      return OK;
-@@ -98,19 +144,36 @@ static const char *dav_fs_cmd_davlockdb(cmd_parms *cmd, void *config,
+@@ -98,19 +144,36 @@
      return NULL;
  }
  
@@ -339,10 +341,8 @@ index 2389f8f..4bf6c51 100644
      dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
                               APR_HOOK_MIDDLE);
      dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
-diff --git a/modules/dav/fs/repos.h b/modules/dav/fs/repos.h
-index b164611..d3a55a5 100644
---- a/modules/dav/fs/repos.h
-+++ b/modules/dav/fs/repos.h
+--- httpd-2.4.58/modules/dav/fs/repos.h.r1912477+
++++ httpd-2.4.58/modules/dav/fs/repos.h
 @@ -25,6 +25,8 @@
  #ifndef _DAV_FS_REPOS_H_
  #define _DAV_FS_REPOS_H_
@@ -352,7 +352,7 @@ index b164611..d3a55a5 100644
  /* the subdirectory to hold all DAV-related information for a directory */
  #define DAV_FS_STATE_DIR                ".DAV"
  #define DAV_FS_STATE_FILE_FOR_DIR       ".state_for_dir"
-@@ -53,8 +55,8 @@ dav_error * dav_fs_get_locknull_members(const dav_resource *resource,
+@@ -53,8 +55,8 @@
  /* DBM functions used by the repository and locking providers */
  extern const dav_hooks_db dav_hooks_db_dbm;
  
@@ -363,7 +363,7 @@ index b164611..d3a55a5 100644
  void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname,
                              const char **state1, const char **state2);
  dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key);
-@@ -64,8 +66,15 @@ void dav_dbm_freedatum(dav_db *db, apr_datum_t data);
+@@ -64,8 +66,15 @@
  int dav_dbm_exists(dav_db *db, apr_datum_t key);
  void dav_dbm_close(dav_db *db);
  
diff --git a/httpd-2.4.59-pr426.patch b/httpd-2.4.59-pr426.patch
new file mode 100644
index 0000000..c0ede88
--- /dev/null
+++ b/httpd-2.4.59-pr426.patch
@@ -0,0 +1,244 @@
+
+https://github.com/apache/httpd/pull/426.patch
+
+Upstream-Status: in trunk, proposed for 2.4.60
+
+--- httpd-2.4.59/modules/ssl/ssl_engine_init.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_engine_init.c
+@@ -880,6 +880,13 @@
+     }
+ #endif
+ 
++#ifdef SSL_OP_NO_RENEGOTIATION
++    /* For server-side SSL_CTX, disable renegotiation by default.. */
++    if (!mctx->pkp) {
++        SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION);
++    }
++#endif
++
+ #ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
+     /* For server-side SSL_CTX, enable ignoring unexpected EOF */
+     /* (OpenSSL 1.1.1 behavioural compatibility).. */
+@@ -908,6 +915,14 @@
+     }
+ }
+ 
++#ifdef SSL_OP_NO_RENEGOTIATION
++/* OpenSSL-level renegotiation protection. */
++#define MODSSL_BLOCKS_RENEG (0)
++#else
++/* mod_ssl-level renegotiation protection. */
++#define MODSSL_BLOCKS_RENEG (1)
++#endif
++
+ static void ssl_init_ctx_callbacks(server_rec *s,
+                                    apr_pool_t *p,
+                                    apr_pool_t *ptemp,
+@@ -921,7 +936,13 @@
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
+ #endif
+ 
+-    SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
++    /* The info callback is used for debug-level tracing.  For OpenSSL
++     * versions where SSL_OP_NO_RENEGOTIATION is not available, the
++     * callback is also used to prevent use of client-initiated
++     * renegotiation.  Enable it in either case. */
++    if (APLOGdebug(s) || MODSSL_BLOCKS_RENEG) {
++        SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
++    }
+ 
+ #ifdef HAVE_TLS_ALPN
+     SSL_CTX_set_alpn_select_cb(ctx, ssl_callback_alpn_select, NULL);
+--- httpd-2.4.59/modules/ssl/ssl_engine_io.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_engine_io.c
+@@ -208,11 +208,13 @@
+ 
+     BIO_clear_retry_flags(bio);
+ 
++#ifndef SSL_OP_NO_RENEGOTIATION
+     /* Abort early if the client has initiated a renegotiation. */
+     if (outctx->filter_ctx->config->reneg_state == RENEG_ABORT) {
+         outctx->rc = APR_ECONNABORTED;
+         return -1;
+     }
++#endif
+ 
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE6, 0, outctx->c,
+                   "bio_filter_out_write: %i bytes", inl);
+@@ -473,11 +475,13 @@
+ 
+     BIO_clear_retry_flags(bio);
+ 
++#ifndef SSL_OP_NO_RENEGOTIATION
+     /* Abort early if the client has initiated a renegotiation. */
+     if (inctx->filter_ctx->config->reneg_state == RENEG_ABORT) {
+         inctx->rc = APR_ECONNABORTED;
+         return -1;
+     }
++#endif
+ 
+     if (!inctx->bb) {
+         inctx->rc = APR_EOF;
+--- httpd-2.4.59/modules/ssl/ssl_engine_kernel.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_engine_kernel.c
+@@ -992,7 +992,7 @@
+ 
+             /* Toggle the renegotiation state to allow the new
+              * handshake to proceed. */
+-            sslconn->reneg_state = RENEG_ALLOW;
++            modssl_set_reneg_state(sslconn, RENEG_ALLOW);
+ 
+             SSL_renegotiate(ssl);
+             SSL_do_handshake(ssl);
+@@ -1019,7 +1019,7 @@
+              */
+             SSL_peek(ssl, peekbuf, 0);
+ 
+-            sslconn->reneg_state = RENEG_REJECT;
++            modssl_set_reneg_state(sslconn, RENEG_REJECT);
+ 
+             if (!SSL_is_init_finished(ssl)) {
+                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
+@@ -1078,7 +1078,7 @@
+         (sc->server->auth.verify_mode != SSL_CVERIFY_UNSET)) {
+         int vmode_inplace, vmode_needed;
+         int change_vmode = FALSE;
+-        int old_state, n, rc;
++        int n, rc;
+ 
+         vmode_inplace = SSL_get_verify_mode(ssl);
+         vmode_needed = SSL_VERIFY_NONE;
+@@ -1180,8 +1180,6 @@
+                 return HTTP_FORBIDDEN;
+             }
+             
+-            old_state = sslconn->reneg_state;
+-            sslconn->reneg_state = RENEG_ALLOW;
+             modssl_set_app_data2(ssl, r);
+ 
+             SSL_do_handshake(ssl);
+@@ -1191,7 +1189,6 @@
+              */
+             SSL_peek(ssl, peekbuf, 0);
+ 
+-            sslconn->reneg_state = old_state;
+             modssl_set_app_data2(ssl, NULL);
+ 
+             /*
+@@ -2263,8 +2260,8 @@
+ /*
+  * This callback function is executed while OpenSSL processes the SSL
+  * handshake and does SSL record layer stuff.  It's used to trap
+- * client-initiated renegotiations, and for dumping everything to the
+- * log.
++ * client-initiated renegotiations (where SSL_OP_NO_RENEGOTIATION is
++ * not available), and for dumping everything to the log.
+  */
+ void ssl_callback_Info(const SSL *ssl, int where, int rc)
+ {
+@@ -2276,14 +2273,12 @@
+         return;
+     }
+ 
+-    /* With TLS 1.3 this callback may be called multiple times on the first
+-     * negotiation, so the below logic to detect renegotiations can't work.
+-     * Fortunately renegotiations are forbidden starting with TLS 1.3, and
+-     * this is enforced by OpenSSL so there's nothing to be done here.
+-     */
+-#if SSL_HAVE_PROTOCOL_TLSV1_3
+-    if (SSL_version(ssl) < TLS1_3_VERSION)
+-#endif
++#ifndef SSL_OP_NO_RENEGOTIATION
++    /* With OpenSSL < 1.1.1 (implying TLS v1.2 or earlier), this
++     * callback is used to block client-initiated renegotiation.  With
++     * TLSv1.3 it is unnecessary since renegotiation is forbidden at
++     * protocol level.  Otherwise (TLSv1.2 with OpenSSL >=1.1.1),
++     * SSL_OP_NO_RENEGOTIATION is used to block renegotiation. */
+     {
+         SSLConnRec *sslconn;
+ 
+@@ -2308,6 +2303,7 @@
+             sslconn->reneg_state = RENEG_REJECT;
+         }
+     }
++#endif
+ 
+     s = mySrvFromConn(c);
+     if (s && APLOGdebug(s)) {
+--- httpd-2.4.59/modules/ssl/ssl_private.h.mr426
++++ httpd-2.4.59/modules/ssl/ssl_private.h
+@@ -558,6 +558,16 @@
+     apr_time_t     source_mtime;
+ } ssl_asn1_t;
+ 
++typedef enum {
++    RENEG_INIT = 0, /* Before initial handshake */
++    RENEG_REJECT,   /* After initial handshake; any client-initiated
++                     * renegotiation should be rejected */
++    RENEG_ALLOW,    /* A server-initiated renegotiation is taking
++                     * place (as dictated by configuration) */
++    RENEG_ABORT     /* Renegotiation initiated by client, abort the
++                     * connection */
++} modssl_reneg_state;
++
+ /**
+  * Define the mod_ssl per-module configuration structure
+  * (i.e. the global configuration for each httpd process)
+@@ -589,18 +599,13 @@
+         NON_SSL_SET_ERROR_MSG  /* Need to set the error message */
+     } non_ssl_request;
+ 
+-    /* Track the handshake/renegotiation state for the connection so
+-     * that all client-initiated renegotiations can be rejected, as a
+-     * partial fix for CVE-2009-3555. */
+-    enum {
+-        RENEG_INIT = 0, /* Before initial handshake */
+-        RENEG_REJECT,   /* After initial handshake; any client-initiated
+-                         * renegotiation should be rejected */
+-        RENEG_ALLOW,    /* A server-initiated renegotiation is taking
+-                         * place (as dictated by configuration) */
+-        RENEG_ABORT     /* Renegotiation initiated by client, abort the
+-                         * connection */
+-    } reneg_state;
++#ifndef SSL_OP_NO_RENEGOTIATION
++    /* For OpenSSL < 1.1.1, track the handshake/renegotiation state
++     * for the connection to block client-initiated renegotiations.
++     * For OpenSSL >=1.1.1, the SSL_OP_NO_RENEGOTIATION flag is used in
++     * the SSL * options state with equivalent effect. */
++    modssl_reneg_state reneg_state;
++#endif
+ 
+     server_rec *server;
+     SSLDirConfigRec *dc;
+@@ -1207,6 +1212,9 @@
+  * the configured ENGINE. */
+ int modssl_is_engine_id(const char *name);
+ 
++/* Set the renegotation state for connection. */
++void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state);
++
+ #endif /* SSL_PRIVATE_H */
+ /** @} */
+ 
+--- httpd-2.4.59/modules/ssl/ssl_util_ssl.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_util_ssl.c
+@@ -612,3 +612,19 @@
+     }
+     return rv;
+ }
++
++void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state)
++{
++#ifdef SSL_OP_NO_RENEGOTIATION
++    switch (state) {
++    case RENEG_ALLOW:
++        SSL_clear_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION);
++        break;
++    default:
++        SSL_set_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION);
++        break;
++    }
++#else
++    sslconn->reneg_state = state;
++#endif
++}
diff --git a/httpd-2.4.62-r1919325.patch b/httpd-2.4.62-r1919325.patch
new file mode 100644
index 0000000..1b344e5
--- /dev/null
+++ b/httpd-2.4.62-r1919325.patch
@@ -0,0 +1,242 @@
+From a0a68b99d131741c1867cff321424892838fc4b3 Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Sat, 27 Jul 2024 13:35:53 +0000
+Subject: [PATCH] mod_rewrite: Better question mark tracking to avoid
+ UnsafeAllow3F.  PR 69197.
+
+Track in do_expand() whether a '?' in the uri-path comes from a literal in
+the substitution string or from an expansion (variable, lookup, ...).
+In the former case it's safe to assume that it's the query-string separator
+but for the other case it's not (could be a decoded %3f from r->uri).
+
+This allows to avoid [UnsafeAllow3F] for most cases.
+
+
+Merges r1919325 from trunk
+Reviewed by: ylavic, covener, jorton
+Github: closes #462
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1919545 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/mappers/mod_rewrite.c | 107 ++++++++++++++++++++++++++++------
+ 1 file changed, 89 insertions(+), 18 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index f1c22e3235b..53fb1e91ffb 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -2376,9 +2376,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c)
+  * of an earlier expansion to include expansion specifiers that
+  * are interpreted by a later expansion, producing results that
+  * were not intended by the administrator.
++ *
++ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark
++ * is found respectively in a literal or in a lookup/expansion (whether
++ * it's the first or last qmark depends on [QSL]). Should be initialized
++ * to -1 and remains so if no qmark is found.
+  */
+-static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
++static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
++                       int *unsafe_qmark)
+ {
++#define EXPAND_SPECIALS "\\$%"
+     result_list *result, *current;
+     result_list sresult[SMALL_EXPANSION];
+     unsigned spc = 0;
+@@ -2386,8 +2393,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+     char *p, *c;
+     apr_pool_t *pool = ctx->r->pool;
+ 
+-    span = strcspn(input, "\\$%");
+     inputlen = strlen(input);
++    if (!unsafe_qmark) {
++        span = strcspn(input, EXPAND_SPECIALS);
++    }
++    else {
++        span = strcspn(input, EXPAND_SPECIALS "?");
++        if (input[span] == '?') {
++            /* this qmark is not from an expansion thus safe */
++            *unsafe_qmark = 0;
++
++            /* keep tracking only if interested in the last qmark */
++            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
++                do {
++                    span++;
++                    span += strcspn(input + span, EXPAND_SPECIALS "?");
++                } while (input[span] == '?');
++            }
++            else {
++                unsafe_qmark = NULL;
++                span += strcspn(input + span, EXPAND_SPECIALS);
++            }
++        }
++    }
+ 
+     /* fast exit */
+     if (inputlen == span) {
+@@ -2405,6 +2433,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+ 
+     /* loop for specials */
+     do {
++        int expanded = 0;
++
+         /* prepare next entry */
+         if (current->len) {
+             current->next = (spc < SMALL_EXPANSION)
+@@ -2450,6 +2480,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                 current->len = span;
+                 current->string = p;
+                 outlen += span;
++
++                expanded = 1;
+                 p = endp + 1;
+             }
+ 
+@@ -2489,19 +2521,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     }
+ 
+                     /* reuse of key variable as result */
+-                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));
+-
++                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL));
+                     if (!key && dflt && *dflt) {
+-                        key = do_expand(dflt, ctx, entry);
++                        key = do_expand(dflt, ctx, entry, NULL);
+                     }
+-
+-                    if (key) {
++                    if (key && *key) {
+                         span = strlen(key);
+                         current->len = span;
+                         current->string = key;
+                         outlen += span;
+                     }
+ 
++                    expanded = 1;
+                     p = endp + 1;
+                 }
+             }
+@@ -2531,8 +2562,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     current->len = span;
+                     current->string = bri->source + bri->regmatch[n].rm_so;
+                 }
+-
+                 outlen += span;
++
++                expanded = 1;
+             }
+ 
+             p += 2;
+@@ -2545,8 +2577,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+             ++outlen;
+         }
+ 
++        if (unsafe_qmark && expanded && current->len
++            && memchr(current->string, '?', current->len)) {
++            /* this qmark is from an expansion thus unsafe */
++            *unsafe_qmark = 1;
++
++            /* keep tracking only if interested in the last qmark */
++            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
++                unsafe_qmark = NULL;
++            }
++        }
++
+         /* check the remainder */
+-        if (*p && (span = strcspn(p, "\\$%")) > 0) {
++        if (!unsafe_qmark) {
++            span = strcspn(p, EXPAND_SPECIALS);
++        }
++        else {
++            span = strcspn(p, EXPAND_SPECIALS "?");
++            if (p[span] == '?') {
++                /* this qmark is not from an expansion thus safe */
++                *unsafe_qmark = 0;
++
++                /* keep tracking only if interested in the last qmark */
++                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
++                    do {
++                        span++;
++                        span += strcspn(p + span, EXPAND_SPECIALS "?");
++                    } while (p[span] == '?');
++                }
++                else {
++                    unsafe_qmark = NULL;
++                    span += strcspn(p + span, EXPAND_SPECIALS);
++                }
++            }
++        }
++        if (span > 0) {
+             if (current->len) {
+                 current->next = (spc < SMALL_EXPANSION)
+                                 ? &(sresult[spc++])
+@@ -2591,7 +2656,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx)
+     char *name, *val;
+ 
+     while (env) {
+-        name = do_expand(env->data, ctx, NULL);
++        name = do_expand(env->data, ctx, NULL, NULL);
+         if (*name == '!') {
+             name++;
+             apr_table_unset(ctx->r->subprocess_env, name);
+@@ -2725,7 +2790,7 @@ static void add_cookie(request_rec *r, char *s)
+ static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx)
+ {
+     while (cookie) {
+-        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL));
++        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL));
+         cookie = cookie->next;
+     }
+ 
+@@ -4014,7 +4079,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx)
+     int basis;
+ 
+     if (p->ptype != CONDPAT_AP_EXPR)
+-        input = do_expand(p->input, ctx, NULL);
++        input = do_expand(p->input, ctx, NULL, NULL);
+ 
+     switch (p->ptype) {
+     case CONDPAT_FILE_EXISTS:
+@@ -4178,7 +4243,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+     char *expanded;
+ 
+     if (p->forced_mimetype) {
+-        expanded = do_expand(p->forced_mimetype, ctx, p);
++        expanded = do_expand(p->forced_mimetype, ctx, p, NULL);
+ 
+         if (*expanded) {
+             ap_str_tolower(expanded);
+@@ -4192,7 +4257,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+     }
+ 
+     if (p->forced_handler) {
+-        expanded = do_expand(p->forced_handler, ctx, p);
++        expanded = do_expand(p->forced_handler, ctx, p, NULL);
+ 
+         if (*expanded) {
+             ap_str_tolower(expanded);
+@@ -4329,12 +4394,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+ 
+     /* expand the result */
+     if (!(p->flags & RULEFLAG_NOSUB)) {
+-        newuri = do_expand(p->output, ctx, p);
++        int unsafe_qmark = -1;
++
++        if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) {
++            newuri = do_expand(p->output, ctx, p, NULL);
++        }
++        else {
++            newuri = do_expand(p->output, ctx, p, &unsafe_qmark);
++        }
+         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+                     newuri));
+-        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
+-            ap_strcasestr(r->unparsed_uri, "%3f") &&
+-            ap_strchr_c(newuri, '?')) {
++
++        if (unsafe_qmark > 0) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10508)
+                     "Unsafe URL with %%3f URL rewritten without "
+                     "UnsafeAllow3F");
+
diff --git a/httpd-2.4.62-r1920980+.patch b/httpd-2.4.62-r1920980+.patch
new file mode 100644
index 0000000..42ca023
--- /dev/null
+++ b/httpd-2.4.62-r1920980+.patch
@@ -0,0 +1,94 @@
+
+https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920566
+https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920980
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 53fb1e9..93ae7ac 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -2404,21 +2404,19 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
+             *unsafe_qmark = 0;
+ 
+             /* keep tracking only if interested in the last qmark */
+-            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
+-                do {
+-                    span++;
+-                    span += strcspn(input + span, EXPAND_SPECIALS "?");
+-                } while (input[span] == '?');
+-            }
+-            else {
++            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
+                 unsafe_qmark = NULL;
+-                span += strcspn(input + span, EXPAND_SPECIALS);
+             }
++
++            /* find the next real special char, any (last) qmark up to
++             * there is safe too
++             */
++            span += strcspn(input + span, EXPAND_SPECIALS);
+         }
+     }
+ 
+-    /* fast exit */
+-    if (inputlen == span) {
++    /* fast path (no specials) */
++    if (span >= inputlen) {
+         return apr_pstrmemdup(pool, input, inputlen);
+     }
+ 
+@@ -2599,16 +2597,14 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
+                 *unsafe_qmark = 0;
+ 
+                 /* keep tracking only if interested in the last qmark */
+-                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
+-                    do {
+-                        span++;
+-                        span += strcspn(p + span, EXPAND_SPECIALS "?");
+-                    } while (p[span] == '?');
+-                }
+-                else {
++                if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
+                     unsafe_qmark = NULL;
+-                    span += strcspn(p + span, EXPAND_SPECIALS);
+                 }
++
++                /* find the next real special char, any (last) qmark up to
++                 * there is safe too
++                 */
++                span += strcspn(p + span, EXPAND_SPECIALS);
+             }
+         }
+         if (span > 0) {
+@@ -4284,6 +4280,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+     char *newuri = NULL;
+     request_rec *r = ctx->r;
+     int is_proxyreq = 0;
++    int prefix_added = 0;
+ 
+     ctx->uri = r->filename;
+ 
+@@ -4444,6 +4441,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                        newuri, ctx->perdir, newuri));
+             newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
++            prefix_added = 1;
+         }
+         else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
+             /* Not an absolute URI-path and the scheme (if any) is unknown,
+@@ -4457,6 +4455,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+                        newuri, newuri));
+ 
+             newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
++            prefix_added = 1;
+         }
+     }
+ 
+@@ -4537,7 +4536,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+         return RULE_RC_MATCH;
+     }
+ 
+-    if (!(p->flags & RULEFLAG_UNC)) {
++    if (!((p->flags & RULEFLAG_UNC) || prefix_added)) {
+         /* merge leading slashes, unless they were literals in the sub */
+         if (!AP_IS_SLASH(p->output[0]) || !AP_IS_SLASH(p->output[1])) {
+             while (AP_IS_SLASH(r->filename[0]) &&
diff --git a/httpd-2.4.64-separate-systemd-fns.patch b/httpd-2.4.64-separate-systemd-fns.patch
deleted file mode 100644
index 6947ee6..0000000
--- a/httpd-2.4.64-separate-systemd-fns.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 05abe18..97484c9 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -631,7 +631,6 @@ case $host in
-       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-         AC_MSG_WARN([Your system does not support systemd.])
-       else
--        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
-         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-       fi
-    fi
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index af68249..7232a45 100644
---- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -40,6 +40,9 @@
- #include <unistd.h>
- #endif
- 
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_journal_stream_fd, (const char *, int, int));
-+
- static char describe_listeners[30];
- 
- static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-@@ -217,10 +220,15 @@ static int ap_systemd_listen_fds(int unset_environment){
-     return sd_listen_fds(unset_environment);
- }
- 
-+static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
-+    return sd_journal_stream_fd("httpd", priority, 0);
-+}
-+
- static void systemd_register_hooks(apr_pool_t *p)
- {
-     APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
-     APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
-+    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
- 
-     /* Enable ap_extended_status. */
-     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
-diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
-index 0848d2e..8af2299 100644
---- a/modules/loggers/config.m4
-+++ b/modules/loggers/config.m4
-@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
- APACHE_MODPATH_INIT(loggers)
- 	
- APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
--APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
- 
- APACHE_MODULE(log_debug, configurable debug logging, , , most)
- APACHE_MODULE(log_forensic, forensic logging)
-diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
-index 694f447..a65b982 100644
---- a/modules/loggers/mod_log_config.c
-+++ b/modules/loggers/mod_log_config.c
-@@ -172,10 +172,6 @@
- #include <limits.h>
- #endif
- 
--#ifdef HAVE_SYSTEMD
--#include <systemd/sd-journal.h>
--#endif
--
- #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
- 
- module AP_MODULE_DECLARE_DATA log_config_module;
-@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
- {
- #ifdef HAVE_SYSTEMD
-     int fd;
-+    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
-+    
-+    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
-+    if (systemd_journal_stream_fd == NULL) {
-+        return APR_ENOTIMPL;
-+    }
- 
--    fd = sd_journal_stream_fd("httpd", priority, 0);
-+    fd = systemd_journal_stream_fd("httpd", priority, 0);
-+    
-     if (fd < 0) return fd;
- 
-     /* This is an AF_UNIX socket fd so is more pipe-like than
-diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
-index 877a593..bd52a98 100644
---- a/modules/loggers/mod_log_config.h
-+++ b/modules/loggers/mod_log_config.h
-@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
-  */
- APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
- 
-+#ifdef HAVE_SYSTEMD
-+APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
-+#endif
-+
- #endif /* MOD_LOG_CONFIG */
- /** @} */
- 
diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch
deleted file mode 100644
index 315b9c2..0000000
--- a/httpd-2.4.65-hcheck-stuck.patch
+++ /dev/null
@@ -1,66 +0,0 @@
---- a/modules/proxy/mod_proxy_hcheck.c
-+++ b/modules/proxy/mod_proxy_hcheck.c
-@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
-     sctx_t *ctx = (sctx_t *)data;
-     server_rec *s = ctx->s;
-     proxy_server_conf *conf;
-+    proxy_worker **workers;
-+    proxy_worker *worker;
-+    apr_time_t now;
-+    int i, n;
- 
-+    conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
-+    balancer = (proxy_balancer *)conf->balancers->elts;
-+
-     switch (state) {
-         case AP_WATCHDOG_STATE_STARTING:
-             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
-                          "%s watchdog started.",
-                          HCHECK_WATHCHDOG_NAME);
-+            /* set last update time for all workers */
-+            now = apr_time_now();
-+            for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
-+                workers = (proxy_worker **)balancer->workers->elts;
-+                for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
-+                    worker = *workers;
-+                    if (worker->s->updated == 0) {
-+                        worker->s->updated = now;
-+                    }
-+                }
-+            }
- #if HC_USE_THREADS
-             if (tpsize && hctp == NULL) {
-                 rv =  apr_thread_pool_create(&hctp, tpsize,
-@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
- 
-         case AP_WATCHDOG_STATE_RUNNING:
-             /* loop thru all workers */
--            if (s) {
--                int i;
--                conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
--                balancer = (proxy_balancer *)conf->balancers->elts;
--                ctx->s = s;
-+            {
-+                now = apr_time_now();
-                 for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
--                    int n;
--                    apr_time_t now;
--                    proxy_worker **workers;
--                    proxy_worker *worker;
-                     /* Have any new balancers or workers been added dynamically? */
-                     ap_proxy_sync_balancer(balancer, s, conf);
-                     workers = (proxy_worker **)balancer->workers->elts;
--                    now = apr_time_now();
--                    for (n = 0; n < balancer->workers->nelts; n++) {
-+                    for (n = 0; n < balancer->workers->nelts; n++, workers++) {
-                         worker = *workers;
-                         if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
-                             (worker->s->method != NONE) &&
-@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
-                                 hc_check(NULL, baton);
-                             }
-                         }
--                        workers++;
-                     }
-                 }
-             }
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 5a3d8ed..5c271f7 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -33,7 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
-     --no-dhparams-file                                             \
+     --dhparams-file       /tmp/dhparams.pem                        \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
diff --git a/httpd.conf b/httpd.conf
index ad5c7ee..609b2e2 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -151,7 +151,7 @@ DocumentRoot "/var/www/html"
     #
     # AllowOverride controls what directives may be placed in .htaccess files.
     # It can be "All", "None", or any combination of the keywords:
-    #   AllowOverride FileInfo AuthConfig Limit
+    #   Options FileInfo AuthConfig Limit
     #
     AllowOverride None
 
@@ -199,7 +199,6 @@ LogLevel warn
     # a CustomLog directive (see below).
     #
     LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
     LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
     <IfModule logio_module>
@@ -217,11 +216,10 @@ LogLevel warn
     #CustomLog "logs/access_log" common
 
     #
-    # If you prefer a logfile with access, agent, referer, and process/thread
-    # information (an extended Combined Logfile Format), you can use the
-    # following directive.
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
     #
-    CustomLog "logs/access_log" combined_ext
+    CustomLog "logs/access_log" combined
 </IfModule>
 
 <IfModule alias_module>
@@ -265,15 +263,6 @@ LogLevel warn
     Require all granted
 </Directory>
 
-<IfModule headers_module>
-    #
-    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
-    # backend servers which have lingering "httpoxy" defects.
-    # 'Proxy' request header is undefined by the IETF, not listed by IANA
-    #
-    RequestHeader unset Proxy early
-</IfModule>
-
 <IfModule mime_module>
     #
     # TypesConfig points to the file containing the list of mappings from
@@ -351,13 +340,6 @@ AddDefaultCharset UTF-8
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #
 
-#
-# MaxRanges: Maximum number of Ranges in a request before
-# returning the entire resource, or one of the special
-# values 'default', 'none' or 'unlimited'.
-# Default setting is to accept 200 Ranges.
-#MaxRanges unlimited
-
 #
 # EnableMMAP and EnableSendfile: On systems that support it, 
 # memory-mapping or the sendfile syscall may be used to deliver
diff --git a/httpd.spec b/httpd.spec
index 45f21c9..43fa7dc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.66
-Release: 1%{?dist}
+Version: 2.4.62
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -89,21 +89,28 @@ Patch3: httpd-2.4.43-deplibs.patch
 Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
 Patch20: httpd-2.4.48-r1842929+.patch
-Patch21: httpd-2.4.64-mod_systemd.patch
+Patch21: httpd-2.4.43-mod_systemd.patch
 Patch22: httpd-2.4.53-export.patch
 Patch23: httpd-2.4.43-corelimit.patch
 Patch24: httpd-2.4.54-icons.patch
 Patch25: httpd-2.4.43-cachehardmax.patch
-Patch26: httpd-2.4.43-sslciphdefault.patch
-Patch27: httpd-2.4.64-sslprotdefault.patch
-Patch28: httpd-2.4.43-logjournal.patch
-Patch29: httpd-2.4.63-r1912477+.patch
-Patch30: httpd-2.4.64-separate-systemd-fns.patch
+Patch26: httpd-2.4.43-socket-activation.patch
+Patch27: httpd-2.4.43-sslciphdefault.patch
+Patch28: httpd-2.4.43-sslprotdefault.patch
+Patch29: httpd-2.4.43-logjournal.patch
+Patch30: httpd-2.4.53-separate-systemd-fns.patch
+Patch31: httpd-2.4.58-r1912477+.patch
+Patch32: httpd-2.4.54-selinux.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch61: httpd-2.4.65-hcheck-stuck.patch
+# https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
+Patch61: httpd-2.4.62-r1919325.patch
+# https://github.com/apache/httpd/pull/473
+# https://github.com/apache/httpd/commit/c91445b7f905587aa86ad552f4a1a3f29345e695
+Patch62: httpd-2.4.62-r1920980+.patch
+
 
 # Security fixes
 # Patch200: ...
@@ -120,7 +127,6 @@ BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
 BuildRequires: openldap-devel
 BuildRequires: systemd-rpm-macros
-BuildRequires: libxcrypt-devel
 %if %{with pcre2}
 BuildRequires: pcre2-devel
 %endif
@@ -846,53 +852,6 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Dec 09 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.66-1
-- new version 2.4.66
-
-* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-5
-- Improve default httpd LogFormats for better support diagnostics
-
-* Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3
-- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
-
-* Tue Nov 04 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
-- mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
-  required for VirtualHost matching.
-
-* Sat Oct 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-1
-- new version 2.4.65
-- mod_proxy_hcheck: reschedule health checks after child process restart
-
-* Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-4
-- Add tmpfiles.d rules for /var directories (bootc compatibility)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.64-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Jul 17 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-2
-- Fix RewriteRule with inverted pattern and RewriteCond regression
-
-* Fri Jul 11 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-1
-- new version 2.4.64
-
-* Tue Jun 24 2025 Joe Orton  <jorton@redhat.com> - 2.4.63-4
-- mod_dav: add dav_get_base_path() API
-
-* Mon Feb 10 2025 Joe Orton <jorton@redhat.com> - 2.4.63-3
-- sync default httpd.conf with upstream
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.4.63-2
-- Add explicit BR: libxcrypt-devel
-
-* Fri Jan 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-1
-- new version 2.4.63
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.62-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.62-5
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
 * Fri Oct 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
 - mod_rewrite: regression fixes
 
diff --git a/httpd.tmpfiles b/httpd.tmpfiles
index a845ab5..f148886 100644
--- a/httpd.tmpfiles
+++ b/httpd.tmpfiles
@@ -1,9 +1,2 @@
 d /run/httpd   710 root apache
 d /run/httpd/htcacheclean   700 apache apache
-d /var/log/httpd 700 root root -
-d /var/www       755 root root -
-d /var/www/html  755 root root -
-d /var/www/cgi-bin 755 root root -
-d /var/lib/httpd 700 apache apache -
-d /var/cache/httpd 700 apache apache -
-d /var/cache/httpd/proxy 700 apache apache -
diff --git a/pullrev.sh b/pullrev.sh
index a87d0dc..f21a7fb 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=$(rpm -q --specfile httpd.spec --qf '%{VERSION}\n' | sed 1q)
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.59
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"
@@ -64,3 +64,4 @@ echo "+ git add ${fn}"
 git add "${fn}"
 echo "+ spec template:"
 echo "PatchN: ${fn}"
+echo "%patch -PN -p1 -b .${suffix}"
diff --git a/sources b/sources
index d84ddb9..2d4ff61 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
-SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd
+SHA512 (httpd-2.4.62.tar.bz2) = 7db1876805d5c0f60f49bcb51f75cdf567120f2ff6349e68f084e9a86ae38265d9f1c67e7fca0082c9db136f3c408a88501ee11f26b1b68724ba240867171d77
+SHA512 (httpd-2.4.62.tar.bz2.asc) = ed4d59fca7e134aa378dddfd0d62973da99fe77a82a48e268e11262af8aca4a4e90133cc979fb39a4f9cb33abbebb10b1345cb52cfad6eb58fc84d3308bc5a39
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192