From afda0405cf7bb768ceb412d75d2f5f193baedd15 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sat, 14 Sep 2013 10:11:47 -0400 Subject: [PATCH] apply @konklone's nginx https: recommendations from https://gist.github.com/konklone/6532544 --- conf/nginx.conf | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/conf/nginx.conf b/conf/nginx.conf index 0df1773..a4fc3e7 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -30,6 +30,15 @@ server { ssl_certificate $STORAGE_ROOT/ssl/ssl_certificate.pem; ssl_certificate_key $STORAGE_ROOT/ssl/ssl_private_key.pem; + # SSL configuration by @konklone at https://gist.github.com/konklone/6532544 + # 1) prefer certain ciphersuites, to enforce Perfect Forward Secrecy and avoid known vulnerabilities. http://ggramaize.wordpress.com/2013/08/02/tls-perfect-forward-secrecy-support-with-apache/ and https://www.ssllabs.com/ssltest/analyze.html + ssl_prefer_server_ciphers on; + ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RC4-SHA:AES256-GCM-SHA384:AES256-SHA256:CAMELLIA256-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA; + # 2) turn on session resumption, using a 10 min cache shared across nginx processes, as recommended by http://nginx.org/en/docs/http/configuring_https_servers.html + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + keepalive_timeout 70; + # We'll expose the same static directory under https. root $STORAGE_ROOT/www/static;