HTTPS config

apache-2.4_tls.conf

SSLCipherSuite ECDHE:DHE:HIGH:+SHA1:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL:!PSK:!RC4
SSLHonorCipherOrder on
SSLProtocol all -SSLv3

<VirtualHost ...>
  SSLEngine on
  Header always set Strict-Transport-Security "max-age=15552000"
  Header set Public-Key-Pins "pin-sha256=\"yiUxVRHwMNoXtZZS/RtgPr2bCNyc6L8IJrmTU80HSlA=\"; pin-sha256=\"XQIfp7PhqFyw93tHv86EhngOxSVVdZy0Dj1mFmI81PM=\"; max-age=15552000"
  SSLUseStapling on
  ...
</VirtualHost>

nginx-1.6_tls.conf

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#ssl_ciphers "EECDHE:EDH:HIGH:+SHA1:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL:!PSK:!RC4:!DSS";
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES128-GCM-SHA256:AES128-SHA256:AES256-SHA:CAMELLIA256-SHA:AES128-SHA:CAMELLIA128-SHA:DES-CBC3-SHA";
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/dhparam.pem; # generate with openssl dhparam -out dhparam.pem 2048
ssl_session_cache shared:SSL:10m;

server {
  ...
  add_header "Strict-Transport-Security" "max-age=15552000";
}