Robert, I think I'm understanding things the way that you do... I need to change some things from the defaults that are in conf/httpd.conf -- for example, Timeout needs to be 60 rather than 300, and ServerTokens needs to be Prod rather than Full. There is a file, /usr/share/doc/httpd-2.4.6/httpd-default.conf that contains those guys. So I would copy that file into conf.d/, and I would edit conf.d/httpd-default.conf and set the Timeout to 60 and the ServerTokens to Prod.

So far, so good... I've kept my customizations in /etc/httpd/conf.d and not messed with conf/httpd.conf, and I've used the template supplied in the install so I've done it in a standard way in a standard place.

So next I need to do some customizing of error logging, and there isn't any template. So I'm thinking that I need to put a file /etc/httpd/conf.d, and I would name it something like error-logging.conf, and then put my old 2.0/2.2 code in that file:

# overrides settings in conf/httpd.conf
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog logs/error_log

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#Prod is "error"
LogLevel warn

#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
#Prod has slightly different LogFormat
#The fromLB variable will be set if the request is routing through the NDH or DDC Netscalers
SetEnvIf Remote_Addr ^((172\.19\.51\.25[23])|(192\.168\.71\.25[23]))$ fromLB
LogFormat "%{Client-IP}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_name}C\" \"%{Content-length}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_name}C\" \"%{Content-length}i\"" combined-direct
LogFormat "%{Client-IP}i %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b" common-direct
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
LogFormat "%{Client-IP}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_name}C\" \"%{SM_USER}i\" %T %P %D %k \"%{SOAPAction}i\" \"%{SOAPAction}o\"" troubleshooting
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_name}C\" \"%{SM_USER}i\" %T %P %D %k \"%{SOAPAction}i\" \"%{SOAPAction}o\"" troubleshooting-direct
# You need to enable mod_logio.c to use %I and %O
#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

#
# The location and format of the access logfile (Common Logfile Format).
# If you do not define any access logfiles within a <VirtualHost>
# container, they will be logged here.  Contrariwise, if you *do*
# define per-<VirtualHost> access logfiles, transactions will be
# logged therein and *not* in this file.
#
CustomLog logs/access_log combined env=fromLB
CustomLog logs/access_log combined-direct env=!fromLB
#
# If you would like to have agent and referer logfiles, uncomment the
# following directives.
#
#CustomLog logs/referer_log referer
#CustomLog logs/agent_log agent

#
# If you prefer a single logfile with access, agent, and referer information
# (Combined Logfile Format) you can use the following directive.
#
#CustomLog logs/access_log combined

Does this sound like I'm doing it the way that they want me to?

Here is another example. In https://access.redhat.com/solutions/385533, there is an instruction "For example see below configuration in /etc/httpd/conf.d/ssl.conf :" followed by a sample configuration.

NameVirtualHost *:443

###  vhost1.example.com #####
<VirtualHost vhost1.example.com:443>

        DocumentRoot /var/www/html/vhost1
        ServerName  vhost1.example.com
        ServerAlias www.vhost1.example.com

        SSLEngine on
        SSLProtocol all -SSLv2
        SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5

        SSLCertificateFile /opt/sslcert/wildcard.example.com.crt
        SSLCertificateKeyFile /opt/sslcert/wildcard.example.com.key

        ErrorLog /var/log/httpd/vhost1_ssl_error_log
        CustomLog /var/log/httpd/vhost1_ssl_access_log common

</virtualhost>

Then in the apache docs, http://httpd.apache.org/docs/2.4/ssl/ssl_howto.html there is this:

Your SSL configuration will need to contain, at minimum, the following directives.

LoadModule ssl_module modules/mod_ssl.so

Listen 443
<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile "/path/to/www.example.com.cert"
    SSLCertificateKeyFile "/path/to/www.example.com.key"
</VirtualHost>

Ok, I'm following that the ServerName, SSLEngine, SSLCertificateFile, and SSLCertificateKeyFile directives that the apache docs say you need are in the suggested /etc/httpd/conf.d/ssl.conf. But two questions:

1) Where should I be putting the LoadModule ssl_module modules/mod_ssl.so command? Some file in conf.modules.d? What file?

2) Everyone else seems to know that the file should be in conf.d and should be called ssl.conf. Where is the documentation of this wisdom?

(I feel like the person who walked into the middle of a conversation and is totally confused!)