Last active
August 29, 2015 14:20
-
-
Save BiCranial/0aa4db8097c6b16e8744 to your computer and use it in GitHub Desktop.
Basic SSL config for Nginx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
server { | |
listen 80 default_server; | |
listen [::]:80 default_server ipv6only=on; | |
server_name name.ext www.name.ext; | |
return 301 https://name.ext$request_uri; | |
} | |
server { | |
listen 443 ssl default_server; | |
listen [::]:443 ssl default_server ipv6only=on; | |
server_name name.ext www.name.ext; | |
add_header X-Frame-Options "SAMEORIGIN"; | |
ssl on; | |
ssl_certificate /path/to/bundle.cer; | |
ssl_certificate_key /path/to/key.pem; | |
ssl_dhparam /path/to/dhparam.pem; | |
ssl_session_timeout 5m; | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
#ssl_ciphers 'AES256+EECDH:AES256+EDH'; # No go for XP, Java, Android < 4.04, probably others | |
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; | |
ssl_prefer_server_ciphers on; | |
ssl_session_cache shared:SSL:10m; | |
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; | |
location / { | |
root /path/to/webroot; | |
index index.html; | |
try_files $uri $uri/ =404; | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment