ssllabs ssl-test pass configuration file Overall Rating : A

nginx-ssl-ssllabs-pass.conf

server {
    # https://www.ssllabs.com/ssltest
    # Overall Rating : A
    # Certificate : 100
    # Protocol Support : 85
    # Key Exchange : 95
    # Cipher Strength : 90

    listen       443;
    server_name  domain;

    server_tokens off;

    ssl                  on;
    ssl_certificate      /etc/nginx/ssl/ssl.crt;
    ssl_certificate_key  /etc/nginx/ssl/ssl.key;

    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;
    
    # ssl resolve dns
    resolver                8.8.8.8;
    ssl_stapling            on;
    ssl_stapling_verify     on;
    ssl_ecdh_curve          secp521r1;
    ssl_trusted_certificate /etc/nginx/ssl/ssl.crt;

    ssl_protocols           SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers   on;
    ssl_ciphers  ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;
    # The following is for reference. It needs to be specified again
    # in each virtualhost, in both HTTP and non-HTTP versions.
    add_header Strict-Transport-Security max-age=2592000;
}