claar · August 29, 2015 14:11 · Dec 18, 2014 · Dec 18, 2014 · Dec 18, 2014 · Dec 18, 2014
diff --git a/nginx.conf b/nginx.conf
@@ -29,6 +29,8 @@
         # http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
         # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
         ssl_session_cache shared:ssl_session_cache:10m;
+        # Default timeout is 5m -- everyone seems to bump it up to 10m, so I'll follow the crowd
+        ssl_session_timeout 10m;
 
         # These ciphers are a subset of FIPS-complient ciphers -- note that IE8 doesn't support any of these ciphers, so 
         # if you need IE8 support, consider using:
@@ -41,3 +43,11 @@
         # http://en.wikipedia.org/wiki/OCSP_stapling
         ssl_stapling on;
         ssl_stapling_verify on;
+        # Set the stapling resolver
+        resolver 8.8.8.8 8.8.4.4;
+
+        # Not sure why everyone sets this, but they do
+        spdy_headers_comp 9;
+
+        # Work-around for BREACH attack: http://breachattack.com/ -- check that this isn't set to on below this line
+        gzip off;
diff --git a/nginx.conf b/nginx.conf
@@ -27,6 +27,7 @@
         # Session resuming / abbreviated handshake for 100ms performance improvement
         # Enable SSL session caching for improved performance
         # http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+        # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
         ssl_session_cache shared:ssl_session_cache:10m;
 
         # These ciphers are a subset of FIPS-complient ciphers -- note that IE8 doesn't support any of these ciphers, so 

diff --git a/nginx.conf b/nginx.conf
@@ -29,7 +29,10 @@
         # http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
         ssl_session_cache shared:ssl_session_cache:10m;
 
-        # These ciphers are a subset of FIPS-complient ciphers
+        # These ciphers are a subset of FIPS-complient ciphers -- note that IE8 doesn't support any of these ciphers, so 
+        # if you need IE8 support, consider using:
+        #
+        #   ssl_ciphers FIPS@STRENGTH:!aNULL:!eNULL;    # https://community.qualys.com/thread/12182
         ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA;
         ssl_prefer_server_ciphers on;
 

diff --git a/nginx.conf b/nginx.conf
@@ -11,7 +11,16 @@
         #
         #   listen 443 ssl spdy;
         ##
-
+
+        ##
+        # For SSL sites, I put this in the ssl section of each site's config:
+        #         
+        #   Enable HSTS -- tell browser this domain and its subdomains should only be accessed via HTTPS for the next 365 days
+        #   add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
+        #
+        # Be careful with the includeSubdomains directive -- obviously if subdomains shouldn't be forced HTTPS, don't use that
+        # directive.
+        ##
         # Fix POODLE
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
@@ -28,6 +37,3 @@
         # http://en.wikipedia.org/wiki/OCSP_stapling
         ssl_stapling on;
         ssl_stapling_verify on;
-
-        # Enable HSTS -- tell browser this domain and its subdomains should only be accessed via HTTPS for the next 365 days
-        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
diff --git a/nginx.conf b/nginx.conf
@@ -1,6 +1,16 @@
         ##
         # Global SSL settings - nginx.conf in http section
         ##
+
+        ##
+        # For additional performance, enable SPDY support for each site by changing the:
+        #
+        #   listen 443 ssl;
+        #
+        # line to:
+        #
+        #   listen 443 ssl spdy;
+        ##
 
         # Fix POODLE
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

diff --git a/nginx.conf b/nginx.conf
@@ -0,0 +1,23 @@
+        ##
+        # Global SSL settings - nginx.conf in http section
+        ##
+
+        # Fix POODLE
+        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+
+        # Session resuming / abbreviated handshake for 100ms performance improvement
+        # Enable SSL session caching for improved performance
+        # http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+        ssl_session_cache shared:ssl_session_cache:10m;
+
+        # These ciphers are a subset of FIPS-complient ciphers
+        ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA;
+        ssl_prefer_server_ciphers on;
+
+        # Enable SSL OCSP stapling -- improves performance and helps CAs
+        # http://en.wikipedia.org/wiki/OCSP_stapling
+        ssl_stapling on;
+        ssl_stapling_verify on;
+
+        # Enable HSTS -- tell browser this domain and its subdomains should only be accessed via HTTPS for the next 365 days
+        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
No results found