Skip to content

Instantly share code, notes, and snippets.

@rl421403

rl421403/nginx.conf

Forked from plentz/nginx.conf
Last active August 29, 2015 14:06
Download ZIP

Revisions

  1. Diego Plentz revised this gist Feb 20, 2014. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    #read more here http://tautt.com/best-nginx-configuration-for-security/

    #don't send the nginx version number in error pages and Server header
    server_tokens off;

  2. Diego Plentz revised this gist Feb 20, 2014. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -44,7 +44,6 @@ server {

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_session_timeout 5m;

    # enables server-side protection from BEAST attacks
    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
  3. @plentz plentz revised this gist Jan 11, 2014. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,10 +1,6 @@
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    @@ -65,6 +61,10 @@ server {
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    #... the rest of your configuration
    }

  4. @plentz plentz revised this gist Nov 26, 2013. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions gistfile1.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,2 @@
    # to generate your dhparam.pem file, run in the terminal
    openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
  5. @plentz plentz revised this gist Nov 26, 2013. 1 changed file with 7 additions and 3 deletions.
    10 changes: 7 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -43,8 +43,12 @@ server {

    # enable session resumption to improve https performance
    # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 5m;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_session_timeout 5m;

    # enables server-side protection from BEAST attacks
    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
    @@ -53,7 +57,7 @@ server {
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ciphers chosen for forward secrecy and compatibility
    # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
    ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
  6. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -9,7 +9,7 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;
    add_header X-Frame-Options SAMEORIGIN;

    # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
    # to disable content-type sniffing on some browsers.
  7. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 14 additions and 0 deletions.
    14 changes: 14 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -11,6 +11,20 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;

    # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
    # to disable content-type sniffing on some browsers.
    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    # currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
    # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
    # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
    add_header X-Content-Type-Options nosniff;

    # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
    # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
    # this particular website if it was disabled by the user.
    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    add_header X-XSS-Protection "1; mode=block";

    # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
  8. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -16,7 +16,8 @@ add_header X-Frame-Options DENY;
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
    # directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # directives for css and js(if you have inline css or js, you will need to keep it too).
    # more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

    server {
  9. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -16,8 +16,7 @@ add_header X-Frame-Options DENY;
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
    # directives for css and js
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

    server {
  10. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,7 +15,8 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
    # directives for css and js
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

  11. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I've disabled it since it have some restrictions, like not executing inline JS anymore
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

    server {
    listen 443 ssl default deferred;
  12. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,8 +15,8 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I've disabled it since it have some restrictions, like not executing inline JS in Chrome
    # https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution
    # I've disabled it since it have some restrictions, like not executing inline JS anymore
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";

    server {
  13. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    add_header X-Content-Security-Policy "default-src 'self'; \
    script-src 'self' https://ssl.google-analytics.com; \
    img-src 'self' https://ssl.google-analytics.com";
    # I've disabled it since it have some restrictions, like not executing inline JS in Chrome
    # https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";

    server {
    listen 443 ssl default deferred;
  14. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 9 additions and 0 deletions.
    9 changes: 9 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -4,12 +4,21 @@ server_tokens off;
    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;

    # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    add_header X-Content-Security-Policy "default-src 'self'; \
    script-src 'self' https://ssl.google-analytics.com; \
    img-src 'self' https://ssl.google-analytics.com";

    server {
    listen 443 ssl default deferred;
    server_name .forgott.com;
  15. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -44,5 +44,5 @@ server {
    server {
    listen 80;
    server_name .forgott.com;
    rewrite ^(.*)$ https://$host$request_uri permanent;
    rewrite ^ https://$host$request_uri permanent;
    }
  16. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -40,11 +40,9 @@ server {
    #... the rest of your configuration
    }

    # redirect all http traffic to https
    server {
    listen 80;
    server_name .forgott.com;

    # redirect all http traffic to https
    rewrite ^(.*)$ https://$host$request_uri permanent;
    break;
    }
  17. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 10 additions and 1 deletion.
    11 changes: 10 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -38,4 +38,13 @@ server {
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    #... the rest of your configuration
    }
    }

    server {
    listen 80;
    server_name .forgott.com;

    # redirect all http traffic to https
    rewrite ^(.*)$ https://$host$request_uri permanent;
    break;
    }
  18. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,7 @@ server_tokens off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    @@ -37,6 +37,5 @@ server {
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;


    #... the rest of your configuration
    }
  19. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 12 additions and 9 deletions.
    21 changes: 12 additions & 9 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,18 @@
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;

    server {
    listen 443 ssl default deferred;
    server_name .forgott.com;
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
    ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
    @@ -27,13 +37,6 @@ server {
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    add_header X-Frame-Options DENY;

    #... the rest of your configuration
    }
  20. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 12 additions and 3 deletions.
    15 changes: 12 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -6,10 +6,19 @@ server {

    ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
    ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    # enable session resumption to improve https performance
    # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # enables server-side protection from BEAST attacks
    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
    ssl_prefer_server_ciphers on;
    # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ciphers chosen for forward secrecy and compatibility
    # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
    ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
  21. @plentz plentz created this gist Sep 28, 2013.
    30 changes: 30 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,30 @@
    server {
    listen 443 ssl default deferred;
    server_name .forgott.com;
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
    ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
    resolver 8.8.8.8;
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    add_header X-Frame-Options DENY;

    #... the rest of your configuration
    }