config_ssl.conf

  ssl    on;
  ssl_protocols TLSv1.2;
  ssl_ciphers EECDH+AESGCM:EECDH+AES:!SHA1:AES256+EECDH:AES256+EDH;
  ssl_session_cache shared:SSL:10m;

  ssl_ecdh_curve secp384r1;

  ssl_prefer_server_ciphers on;
  ssl_dhparam /etc/nginx/dh4096.pem;

  add_header Strict-Transport-Security "max-age=63072000; preload";
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  
  ssl_stapling on;
  ssl_stapling_verify on;

  resolver 8.8.4.4 8.8.8.8 valid=300s;
  resolver_timeout 10s;
  
  ssl_certificate         /etc/letsencrypt/live/domain.tld/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/domain.tld/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/domain.tld/chain.pem;