Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating

nginx-tls.conf

#
# Enables HTTP/2, PFS, HSTS and OCSP stapling. 
#

server {
  listen [::]:80;
  listen      80;
  server_name lex-ui.dev.azure...;

  # Redirect all non-https requests
  rewrite ^ https://$host$request_uri? permanent;
}

server {
  listen [::]:443 ssl http2 default_server;
  listen      443 ssl http2 default_server;

  server_name lex-ui.dev.azure...;

  # Certificate(s) and private key
  ssl_certificate /etc/ssl/lex-certificate-path/public-cert.crt;
  ssl_certificate_key /etc/ssl/lex-certificate-path/private.key;

  # RFC-7919 recommended: https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe4096
  ssl_dhparam /etc/ssl/ffdhe4096.pem;

  # Or, generate random dhparam
  # openssl dhparam 4096 -out /etc/ssl/dhparam.pem
  # ssl_dhparam /etc/ssl/dhparam.pem;

  ssl_protocols TLSv1.3 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ecdh_curve secp521r1:secp384r1;
  ssl_ciphers EECDH+AESGCM:EECDH+AES256;

  ssl_session_cache shared:TLS:2m;
  ssl_buffer_size 4k;

  # OCSP stapling # GMA - might cause issues with self signed certificates
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]; # Cloudflare

  # Set HSTS to 365 days
  add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
  
  location / {
    proxy_pass http://127.0.0.1:5000; # redirecting the traffic to your application running on port 5000
  }
}