Skip to content

Instantly share code, notes, and snippets.

@PaulGWebster
Created June 3, 2022 20:22
Show Gist options
  • Save PaulGWebster/520bba31a34193eab56c1f8bc86b6f87 to your computer and use it in GitHub Desktop.
Save PaulGWebster/520bba31a34193eab56c1f8bc86b6f87 to your computer and use it in GitHub Desktop.
SSL issues and nginx config
root@gateway:/usr/local/etc/nginx/sites-enabled # cat ../conf.d/ssl.conf
## Improves TTFB by using a smaller SSL buffer than the nginx default
ssl_buffer_size 8k;
resolver 8.8.8.8;
ssl_stapling_verify on;
ssl_session_timeout 30m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
ssl_session_cache shared:SSL:10m;
ssl_dhparam /etc/ssl/dhparams.pem;
ssl_prefer_server_ciphers on;
root@gateway:/usr/local/etc/nginx/sites-enabled # cat perl.place
server {
listen 443 ssl;
server_name perl.place;
ssl_certificate /mnt/ssl/nginx/perl.place/fullchain.pem;
ssl_certificate_key /mnt/ssl/nginx/perl.place/privkey.pem;
ssl_trusted_certificate /mnt/ssl/nginx/perl.place/chain.pem;
location = / {
proxy_pass http://127.0.0.1:81;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Server-Select $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Url-Scheme: $scheme;
proxy_set_header Host $host;
proxy_http_version 1.1;
proxy_cache off;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment