Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating
# Name: nginx-tls.conf
# Auth: Gavin Lloyd <>
# Desc: Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating
# Enables HTTP/2, PFS, HSTS and OCSP stapling. Configuration options not related
# to SSL/TLS are not included here.
# Additional tips:
# * Enable CAA DNS record:
# Example:
server {
listen [::]:80;
listen 80;
server_name domain.tld www.domain.tld;
# Redirect all non-https requests
rewrite ^ https://$host$request_uri? permanent;
server {
listen [::]:443 ssl http2 default_server;
listen 443 ssl http2 default_server;
server_name domain.tld www.domain.tld;
# Certificate(s) and private key
ssl_certificate /etc/ssl/domain.crt;
ssl_certificate_key /etc/ssl/domain.key;
# RFC-7919 recommended:
ssl_dhparam /etc/ssl/ffdhe4096.pem;
# Or, generate random dhparam
# openssl dhparam 4096 -out /etc/ssl/dhparam.pem
# ssl_dhparam /etc/ssl/dhparam.pem;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp521r1:secp384r1;
ssl_ciphers EECDH+AESGCM:EECDH+AES256;
ssl_session_cache shared:TLS:2m;
ssl_buffer_size 4k;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver [2606:4700:4700::1111] [2606:4700:4700::1001]; # Cloudflare
# Set HSTS to 365 days
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
Copy link

Mageek627 commented Mar 22, 2022

No need for ssl_dhparam at all

Copy link

beatquantum commented Mar 23, 2022

Thanks @Mageek627 . You are right. No need for ssl_dhparam. Here is my latest configuration on nginx 1.21.6

ssl_prefer_server_ciphers on;
ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256;
ssl_conf_command Options ServerPreference,PrioritizeChaCha,NoRenegotiation,NoResumptionOnRenegotiation;
ssl_ecdh_curve secp521r1:secp384r1;

Copy link

stevenlafl commented Jun 10, 2022

Here is one from the NSA/, ref &

ssl_protocols TLSv1.3 TLSv1.2;
ssl_ecdh_curve secp384r1;	
ssl_prefer_server_ciphers on;
ssl_session_tickets off;

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment