Nginx TLS vHost config

gistfile1.txt

server {
    listen 443 default_server ssl;
    server_name CHANGEME
    server_tokens off;
    ssl_certificate CHANGEME.crt;
    ssl_certificate_key CHANGEME.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:ssl_session_cache:10m;

    # TLS Perfect Forward Secrecy
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";
    ssl_dhparam dh4096.pem;

    # HTTP Strict Transport Security
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    add_header X-Frame-Options SAMEORIGIN;
}