[nginx] Configure SSL.

Parameter values taken from Let's Encrypt.

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index bf7dfe78a552587e9cf8fc7a51ad2763b413e881..128c081a949709221d9504df7c9a4ab2aa78643c 100644 (file)
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -35,8 +35,14 @@ http {
     # SSL Settings
     ##
 
-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
-    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:le_nginx_SSL:10m;
+    ssl_session_timeout 1440m;
+    ssl_session_tickets off;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
 
     ##
     # Logging Settings