Nginx site conf for getting Grade A+ on Qualys SSL Server Test

nginx.your.domain.conf

# Nginx site conf for getting Grade A+ on Qualys SSL Server Test
#
# Target environment
# Nginx: 1.10.1
# OpenSSL: 1.0.1t
#
# moz://a SSL Configuration Generator
# https://ssl-config.mozilla.org/

# Qualys SSL Server Test
# https://www.ssllabs.com/ssltest/index.html
#

server {
  listen 80;
  listen [::]:80;

  server_name your.domain;

  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  ssl_certificate /etc/letsencrypt/live/your.domain/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/your.domain/privkey.pem;
  # enable session resumption to improve https performance
  # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
  ssl_session_timeout 1d;
  ssl_session_cache shared:MozSSL:10m;

  # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
  #
  # generate by yourself
  # openssl dhparam -out dhparam.pem 4096
  ssl_dhparam /path/to/dhparam;

  # intermediate configuration  
  ssl_protocols TLSv1.2;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers off;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
  add_header Strict-Transport-Security "max-age=63072000; includeSubdomains;";

  # OCSP stapling
  # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
  # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
  ssl_stapling on;
  ssl_stapling_verify on;

  # verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate /etc/letsencrypt/live/your.domain/fullchain.pem;

  # replace with the IP address of your resolver
  # Google DNS
  resolver 8.8.8.8;

  add_header X-Content-Type-Options "nosniff" always;
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-Xss-Protection "1";
  add_header Content-Security-Policy "default-src 'self'";

  server_name your.domain;

  access_log /var/log/nginx/access.your.domain.log;
  error_log /var/log/nginx/error.your.domain.log;
  
}