nginx_ssl

   ssl_certificate /etc/nginx/ssl/site.bundle.cer;
    ssl_certificate_key /etc/nginx/ssl/site.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_dhparam /etc/nginx/ssl/wildcard/dhparam.pem;
    # Set the ciphers to use. You may have to fix formatting. 
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
    
    add_header Strict-Transport-Security max-age=63072000;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

openssl dhparam -out dhparams.pem 2048
and added it in my nginx configuration:

ssl_dhparam dhparams.pem;
But the connection from my app still fails. The nsurl --ats-diagnostics tool still indicates that the problem is caused by forward secrecy.

http://www.yunsonbai.top/2016/06/09/nginx-https%E9%85%8D%E7%BD%AE/

https://blog.netsh.org/posts/nginx-certificate-transparency_2256.netsh.html

http://blog.csdn.net/xyt8023y/article/details/50780818