Nginx SSL/TLS configuration for “A+” Qualys SSL Labs ratin

## Name: nginx-tls.conf# Auth: James Lau # Date: 09 Dec 2015# Desc: Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating## Enables HTTP/2, PFS, HSTS and OCSP stapling. Configuration options not related# to SSL/TLS are omitted here.## Example: https://www.ssllabs.com/ssltest/analyze.html?d=yusky.me#server {listen [::]:80;listen 80;server_name domain.tld www.domain.tld;# Redirect all non-https requestsrewrite ^ https://$host$request_uri? permanent;}server {listen [::]:443 default_server ssl http2;listen 443 default_server ssl http2;server_name domain.tld www.domain.tld;# Certificate(s) and private keyssl_certificate /etc/ssl/domain.crt;ssl_certificate_key /etc/ssl/domain.key;# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bitsssl_dhparam /path/to/dhparam.pem;ssl_protocols TLSv1.2 TLSv1.1 TLSv1;ssl_prefer_server_ciphers on;ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;ssl_session_timeout 1d;ssl_session_cache shared:TLS:10m;ssl_session_tickets off;# OCSP staplingssl_stapling on;ssl_stapling_verify on;resolver 43.225.44.1; # hp.hupo.hk## verify chain of trust of OCSP response using Root CA and Intermediate certsssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;# Set HSTS to 365 daysadd_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';}