Nginx SSL/TLS configuration for “A+” Qualys SSL Labs rating

#
# Name: nginx-tls.conf
# Auth: James Lau 
# Date: 09 Dec 2015
# Desc: Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating
#
# Enables HTTP/2, PFS, HSTS and OCSP stapling. Configuration options not related
# to SSL/TLS are omitted here.
#
# Example: https://www.ssllabs.com/ssltest/analyze.html?d=yusky.me
#

server {
  listen [::]:80;
  listen      80;
  server_name domain.tld www.domain.tld;

  # Redirect all non-https requests
  rewrite ^ https://$host$request_uri? permanent;
}

server {
  # listen [::]:443 default_server ssl;
  listen      443 default_server ssl;

  server_name domain.tld www.domain.tld;

  # 证书和私钥路径配置
  ssl_certificate /etc/ssl/domain.crt;
  ssl_certificate_key /etc/ssl/domain.key;
  
  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
  # ssl_dhparam /path/to/dhparam.pem;
  # 这个可忽略，没啥用

  ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

  ssl_session_timeout 1d;
  ssl_session_cache shared:TLS:10m;

  # 忽略
  # OCSP stapling
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #resolver 43.225.44.1; # hp.hupo.hk
  
  #忽略
  ## verify chain of trust of OCSP response using Root CA and Intermediate certs
  #ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
  
  # Set HSTS to 365 days   HSTS一般用不到。  根据需求配置。  HSTS的功能请看百科。
  #add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
}