# generated by https://mozilla.github.io/server-side-tls/ssl-config-generator/ # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits ssl_dhparam /etc/resty-auto-ssl/dhparam.pem; # intermediate configuration. tweak to your needs. ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers on; # HSTS (uses headers-more-nginx-module included with openresty) (15768000 seconds = 6 months) # uncomment if you are sure you'll never drop HTTPS support # more_set_headers Strict-Transport-Security max-age=15768000;