97.nginx

server {
	listen 443;
	server_name domain.org;

	root /usr/share/nginx/domain.org;
	index index.html;

	ssl on;
	ssl_certificate /root/ssl/bundle.crt;
	ssl_certificate_key /root/ssl/domain.org.key;
	ssl_dhparam /root/ssl/dhparam.pem;
	#ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
	ssl_ciphers ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:SH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!kEDH;
	ssl_protocols TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_session_cache shared:SSL:10m;
	add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
	add_header X-Frame-Options DENY;
	add_header X-Content-Type-Options nosniff;
	ssl_stapling on; # Requires nginx >= 1.3.7
	ssl_stapling_verify on; # Requires nginx => 1.3.7

	location / {
		try_files $uri $uri/ =404;
	}
}