StartSSL SSL Labs A+ nginx.conf

StartSSL SSL Labs A+

	ssl_session_cache shared:ssl_session_cache:10m;
	server {
		server_name domen.com www.domen.com;
		listen xxx.xxx.xxx.xxx:80;
		return 301 https://domen.com$request_uri;
	}

	server {
		server_name domen.com www.domen.com;
		listen 443 ssl spdy;
		listen [::]:443 ssl spdy;
		charset UTF-8;

		ssl on; 
		ssl_certificate /var/www/httpd-cert/domen.com.crt;
		ssl_certificate_key /var/www/httpd-cert/domen.com.key;
		ssl_dhparam  /var/www/httpd-cert/domen.com.pem; #openssl dhparam -out /var/www/httpd-cert/domen.com.pem 4096
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
		ssl_prefer_server_ciphers on;

		ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
		ssl_session_cache shared:SSL:10m;
		ssl_session_timeout 10m;
		ssl_buffer_size 8k;
		resolver 8.8.8.8 8.8.4.4 127.0.0.1;
		resolver_timeout 10s;
		ssl_stapling on;
		ssl_stapling_verify on;
		ssl_trusted_certificate /var/www/httpd-cert/startssl_trust_chain.pem; #copy https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
		#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
		add_header Strict-Transport-Security "max-age=31536000;";

		#location rules
    }