some SSL / TLS hardening based on bettercrypto

honeymap-ssl-ngninx.conf

map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
}

server {
        listen   8443 ssl;
        ssl_certificate     /etc/ssl/private/mhn.yourcompany.com.pem;
        ssl_certificate_key /etc/ssl/private/mhn.yourcompany.com.pem;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # not possible to do exclusive
        ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA';
        add_header Strict-Transport-Security max-age=15768000; # six months
        
        root /opt/honeymap/client;
        index index.html index.htm;

        server_name mhn.yourcompany.com;

        location / {
                try_files $uri $uri/ /index.html;
        }

        location /data/ {
                proxy_pass http://localhost:3000;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $connection_upgrade;
        }
}

mhn-ssl-nginx.conf

server {
    listen   80;
    #listen   [::]:80; # For ipv6
    listen   443 default ssl;
    server_name         mhn.yourcompany.com;
    ssl_certificate     /etc/ssl/private/mhn.yourcompany.com.pem;
    ssl_certificate_key /etc/ssl/private/mhn.yourcompany.com.pem;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # not possible to do exclusive
    ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA';
    add_header Strict-Transport-Security max-age=15768000; # six months

    if ($ssl_protocol = "") {
        rewrite ^ https://$host$request_uri? permanent;
    }

    location / { 
        try_files $uri @mhnserver; 
    }
    
    root /opt/www;

    location @mhnserver {
      include uwsgi_params;
      uwsgi_pass unix:/tmp/uwsgi.sock;
    }

    location  /static {
      alias /opt/mhn/server/mhn/static;
    }
}