nano /etc/apache2/sites-available/default-ssl.conf

<VirtualHost *:443>
...
Header always set X-Content-Type-Options "nosniff"
...
</VirtualHoste>