How to update Server 5 to TLS 1.2? In the latest version of Apple's Server app version 5.0.4 running on El Capitan (10.11.2), SSL websites use TLS version 1.0. But, as one Ivan Ristic says, « The bottom line is that TLS 1.0 is insecure and we must migrate away from it ». How to achieve that with Server 5?
Go to http://www.apple.com/feedback and send feedback demanding that they update Server and OS X to support TLS 1.2. It's ridiculous that they don't, especially considering that in iOS 9 and El Capitan they require that Apple developers release software that only talks to TLS 1.2 servers. Even if you could patch Server to work with TLS 1.2, what happens when Apple updates Server again, and it still doesn't support TLS 1.2? When you install that update, will it overwrite whatever you put into place?
In the mean time, the only real option you have, I guess, is to install OpenSSL 1.0.1 or later, download the Apache source code, and then build it linking against OpenSSL 1.0.1, and then replace OS X's Apache with the one you just built. That will almost certainly require disabling System Integrity Protection because you can't modify the core OS files like apache2. You might be able to get away with just swapping out mod_ssl.so after you do your build. But it's ridiculous that we'd even have to resort to this! Apple needs to fix this!!! (see https://serverfault.com/questions/265556/upgrade-openssl-mod-ssl-on-mac-os-x-server)
Download VirtualBox, and install CentOS or another security-enhanced Linux flavor, and just run your server out of that on the Mac. Because, evidently, Apple CBA to chew gum and walk at the same time.


UPDATE:

Here are the exact steps that I did to get (2.) above to work.

This gets OS X Server 5 to work with TLS 1.2 and forward secrecy on 10.11.1, making ATS perfectly happy (especially if you're a developer this is really cool).


Install Homebrew and brew install openssl, brew install PCRE
Download the latest source for Apache, apr, and apr-util
Extract Apache source into /usr/local/src/httpd-2.4.17
Extract apr and apr-util archives to /usr/local/src/httpd-2.4.17/srclib/apr and /usr/local/src/httpd-2.4.17/srclib/apr-util
Replace the character "+" with the word "apache2" in the files config.layout inside the apr and apr-util dirs
In Terminal, execute the following commands:

cd /usr/local/src/httpd-2.4.17
CFLAGS="-arch x86_64"
./configure --prefix=/usr/local/apache-2.4.17 --with-included-apr --with-included-apr-util -with-mpm=prefork --with-ssl=/usr/local/opt/openssl --enable-mods-shared=reallyall --enable-layout=Darwin
make
make install

Copy mod_hfs_apple.so, mod_authnz_ldap.so, and mod_ldap.so from /usr/libexec into /usr/local/apache-2.4.17/libexec/apache2/
Disable SIP: Restart into Recover mode (command-R), open Terminal, and type csrutil disable. (This allows you to be able to make changes inside the /usr/sbin and /usr directories, necessary to swap out the insecure default Apache with the new secure one you'll be building.)
Restart back into normal mode, open Terminal, and type the following commands:

sudo mv /usr/sbin/httpd /usr/sbin/httpd.old
sudo mv /usr/libexec/apache2 /usr/libexec/apache2.old
sudo ln -s /usr/local/apache-2.4.17/sbin/httpd /usr/sbin/httpd
sudo ln -s /usr/local/apache-2.4.17/libexec/apache2/ /usr/libexec/apache2

Re-enable SIP: restart into Recover mode, open Terminal, and type csrutil enable. 
Restart back into normal mode and download the latest source for PHP, then extract it to /usr/local/src/php-5.6.16 (or whatever version; 7.0 just came out, woot, but I don't know if it would break OS X Server's own uses of PHP)
Configure PHP with the following command (modify as needed, but this worked for my LAMP stack with OS X Server 5):

ln -s /usr/local/opt/openssl /usr/local/openssl
cd /usr/local/src/php-5.6.16
CFLAGS="-arch x86_64" 
./configure --with-openssl=/usr/local/opt/openssl --with-pcre-regex=/usr/local/opt/pcre --with-curl=/usr/bin/curl --enable-exif --with-mysql=/usr/local/mysql --with-mysql-sock=/tmp/mysql.sock --with-pdo-mysql --enable-opcache --with-apxs2=/usr/local/apache-2.4.17/bin/apxs --prefix=/usr/local/apache-2.4.17/php/ --enable-sockets --enable-zip --with-pear=/usr/local/apache-2.4.17/lib/php --enable-mbstring --with-mysqli
make
make install

In a text editor, edit the file:
/Library/Server/Web/Config/Proxy/servermgr_serviceproxy_customsites.plist
Starting at line 65, perform these changes (lines to delete, new lines):


  SSLCipherSuite &quot;ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM&quot;
  
  SSLCipherSuite &quot;ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS&quot;
  
  SSLHonorCipherOrder On
  
  SSLProtocol -ALL +TLSv1
  
  SSLProtocol -SSLv2 -SSLv3
  
  SSLProxyProtocol -ALL +TLSv1
  
  SSLProxyProtocol -SSLv2 -SSLv3

Next, make a similar change in apache_serviceproxy_customsites.conf, starting at line 13 (lines to delete, new lines):


  SSLCipherSuite "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM"
  
  SSLHonorCipherOrder On
  
  SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS"
  
  SSLProtocol -ALL +TLSv1
  
  SSLProtocol ALL -SSLv2 -SSLv3
  
  SSLProxyProtocol -ALL +TLSv1
  
  SSLProxyProtocol ALL -SSLv2 -SSLv3

Next, make the exact same changes as in step 14., in apache_serviceproxy.conf, starting at line 198.
Start OS X server and run the following command to verify that you have succeeded:
/usr/bin/nscurl --ats-diagnostics https :// [[your custom site's https url]]
Note: the URL will obviously need to be formatted properly. I put an extra space in there before the colon because otherwise this post gets sent to moderation.


In my case ALL of the tests came back with a "PASS."

I can provide you a git patch file to make the changes to your .conf files assuming you still have a virgin install and you're on the same version as me.