Nginx SSL configuration for A+ grade

example_ssl.conf

listen                      443 ssl spdy;
ssl                         on;
ssl_protocols               TLSv1.2 TLSv1.1 TLSv1;
ssl_session_cache           shared:SSL:20m;
ssl_session_timeout         10m;
ssl_ciphers                 'EECDH+ECDSA+AESGCM:AES128+EECDH:AES128+EDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!CAMELLIA:!ADH';
ssl_prefer_server_ciphers   on;

resolver                    8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout            10s;
add_header                  X-Frame-Options             "DENY";
add_header                  X-Content-Type-Options      "nosniff";
add_header                  Strict-Transport-Security   "max-age=31536000";
add_header                  Public-Key-Pins 'pin-sha256="[SOME_BASE64]"; max-age=5184000;';  #[SOME_BASE64] надо выставлять свое, гуглить как считать Public-Key-Pins
ssl_stapling            on;
ssl_trusted_certificate /etc/nginx/ssl/[SITE]/trustchain.pem;
ssl_certificate         /etc/nginx/ssl/[SITE]/server.crt;
ssl_certificate_key     /etc/nginx/ssl/[SITE]/server.key;
ssl_dhparam             /etc/nginx/ssl/[SITE]/dh.pem;        #openssl dhparam 2048 -out dh.pem