Nginx TLS config #book

nginx_tls.conf

server { 
   listen                    443 ssl;    
   server_name               example.com;
   ssl                       on;

   # enable HSTS
   add_header                Strict-Transport-Security "max-age=63072000; includeSubdomains;";
   
   # prevent clickjacking
   add_header X-Frame-Options "SAMEORIGIN"; 

   # allow using a cdn for images but insist all other content comes from us
   add_header Content-Security-Policy "default-src 'self'; img-src *; frame-ancestors 'none';"; 
   
   ssl_certificate           /opt/cert/example.pem; 
   ssl_certificate_key       /opt/cert/example.key; 
   ssl_protocols             TLSv1.2 TLSv1.3;    
   ssl_prefer_server_ciphers on; 
   ssl_session_cache         shared:SSL:10m;
   
   # Ciphers for intermediate TLS1.2 and TLS1.3 (https://wiki.mozilla.org/Security/Server_Side_TLS)
   ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
   
   # Avoid precompute attacks against nginx default https://en.wikipedia.org/wiki/Logjam_(computer_security)
   # Generate by running "openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096"
   ssl_dhparam               /etc/ssl/certs/dhparam.pem;  
   ssl_ecdh_curve            secp384r1; 
}