fix: disable ssl session tickets

fixes #972695

Based on
mozilla/server-side-tls#135 and
https://www.imperialviolet.org/2013/06/27/botchingpfs.html
session tickets are a complicated mechanism that’s easy to get wrong.
Proper use also requires daily reloading of the server.
They are only relevant for TLS1.2.
If anyone needs the performance boost, they can enable it again.

debian/config-dir/mods-available/ssl.conf

@@ -77,3 +77,7 @@ SSLProtocol all -SSLv3
 #   Whether to forbid non-SNI clients to access name based virtual hosts.
 #   Default: Off
 #SSLStrictSNIVHostCheck On
+
+# Warning: Session Tickets require regular reloading of the server!
+# Make sure you do this (e.g. via logrotate) before changing this setting!
+SSLSessionTickets off