Inexor's Lets Encrypt SSL configuration for nginx

httpd.conf

        
        # A server block that will by default redirect all traffic HTTPS
        server {
          listen 80 default_server;
          return 301 https://$host$request_uri;
        }
      
	      
	      ##
	      # Global SSL configuration
	      ##

        # loads certificate and private key
	      ssl_certificate /etc/letsencrypt/live/domain/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/domain/privkey.pem;

        # strongest ciphers first, explicitly blacklisting ciphers
	      ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
 
	      # prefer above order of ciphers
        ssl_prefer_server_ciphers on;

        # tls only
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

        # using more than 1024 bits will break java 6 compatibility ... 
        ssl_dhparam /etc/nginx/dhparams.pem;

        # performance optimization
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # enforce https for 90 days - no more self-signed certificates
        add_header "Strict-Transport-Security" "max-age=129600; includeSubDomains";

	    # ssl stapling
	    ssl_stapling on;
    	ssl_stapling_verify on;
    	resolver 8.8.8.8 8.8.4.4 valid=300s;
    	resolver_timeout 5s;

	    ssl_trusted_certificate /etc/letsencrypt/live/domain/fullchain.pem;