Zabbix Server option:
TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
Proxy server option:
TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
This forces proxies to communicate to the server via the above ciphers in order. To check what ciphers a server supports run this command:
openssl ciphers -v | column -t
Disable CBC ciphers in apache:
edit /etc/apache2/mods-enabled/ssl.conf
SSLCipherSuite HIGH:!RSA:!CAMELLIA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SHA1:!SHA256:!SHA384
SSLOptions +StrictRequire -OptRenegotiate
edit /etc/letsencrypt/options-ssl-apache.conf
SSLCipherSuite HIGH:!RSA:!CAMELLIA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SHA1:!SHA256:!SHA384
SSLOptions +StrictRequire -OptRenegotiate
See here for Zabbix best security practises
Best practices for secure Zabbix setup