Last active
May 31, 2017 08:09
-
-
Save PavloBezpalov/64ce06c79b76482c330a01d4c5a79768 to your computer and use it in GitHub Desktop.
Nginx 1.11+ SSL A+
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ADD TO HTTP OR SERVER BLOCK | |
| ssl_protocols TLSv1.2; | |
| ssl_prefer_server_ciphers on; | |
| ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; | |
| ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 | |
| ssl_session_cache shared:SSL:10m; | |
| ssl_session_tickets off; # Requires nginx >= 1.5.9 | |
| ssl_stapling on; # Requires nginx >= 1.3.7 | |
| ssl_stapling_verify on; # Requires nginx => 1.3.7 | |
| resolver 8.8.8.8 8.8.4.4 valid=300s; | |
| resolver_timeout 5s; | |
| add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; | |
| add_header X-Frame-Options DENY; | |
| add_header X-Content-Type-Options nosniff; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| recommendations https://cipherli.st/ | |
| test ssl https://www.ssllabs.com/ssltest/analyze.html |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment