Add
Header add Strict-Transport-Security "max-age=15768000"
to our https webservers. a2enmod headers is needed for this as well.