From 80f3175a0e870f54d7e343a0ce2a47aef02e6bd6 Mon Sep 17 00:00:00 2001 From: ansuz Date: Fri, 27 Dec 2019 13:05:02 -0500 Subject: [PATCH] simplify cipher list, better dhparams --- docs/example.nginx.conf | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf index 70b62b709..b9bb71d4a 100644 --- a/docs/example.nginx.conf +++ b/docs/example.nginx.conf @@ -31,16 +31,25 @@ server { # nginx doesn't let you set server_name via variables, so you need to hardcode your domains here server_name your-main-domain.com your-sandbox-domain.com; + # You'll need to Set the path to your certificates and keys here ssl_certificate /home/cryptpad/.acme.sh/your-main-domain.com/fullchain.cer; ssl_certificate_key /home/cryptpad/.acme.sh/your-main-domain.com/your-main-domain.com.key; ssl_trusted_certificate /home/cryptpad/.acme.sh/your-main-domain.com/ca.cer; - ssl_dhparam /etc/nginx/dhparam.pem; + # diffie-hellman parameters are used to negotiate keys for your session + # generate strong parameters using the following command + ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096 + + # Speeds things up a little bit when resuming a session ssl_session_timeout 5m; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # omit SSLv3 because of POODLE - # ECDHE better than DHE (faster) ECDHE & DHE GCM better than CBC (attacks on AES) Everything better than SHA1 (deprecated) - ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA'; - ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:5m; + + # You'll need nginx 1.13.0 or better to support TLSv1.3 + ssl_protocols TLSv1.2 TLSv1.3; + + # https://cipherli.st/ + ssl_ciphers EECDH+AESGCM:EDH+AESGCM; + ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-XSS-Protection "1; mode=block";