Add this to your Apache config:
LoadModule log_forensic_module modules/mod_log_forensic.so
Restart Apache
Set the location of the forensic log.
ForensicLog /var/log/apache2/forensic.log
Here is an example of an entry in forensic:
+16831:68ca525e:3c5|GET /some/url HTTP/1.1|sec-fetch-dest:document|user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15........
Some of the cheaper or newer SSL suppliers will require this to work properly (otherwise you may be prompted that the cert is invalid when it's not the case but it will certainly scare off your users!).
In the Apache vhost conf for the domain here is what you add:
SSLCACertificateFile /path/to/your/cafile.pem
Here is a full example of an SSL Vhost config in Apache using a CA Certificate file
........