vikarti.anatra/nginx-ultimate-bad-bot-blocker
1
0
Fork 0
mirror of https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker.git synced 2025-09-01 01:59:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

UPDATE ssl.d/globalssl.conf [ci skip]

Browse source 
Recommended SSL settings for all nginx sites
This commit is contained in:
Mitchell Krog 2019-07-04 13:23:16 +02:00
parent 454606ad3c
commit 90e8578247
No known key found for this signature in database
GPG key ID: C243C388553EDE5D
1 changed files with 31 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
ssl.d/globalssl.conf
View file

@ -54,7 +54,7 @@
# include /etc/nginx/ssl.d/globalssl.conf;
##
##
# DIFFIE HELMAN ENCRYPTION / DHE
##
@ -78,24 +78,47 @@
##
# SSL PROTOCOL SUPPORT
# Support modern and intermediate browsers ONLY
# If you want to allow some older browsers add TLSv1 TLSv1.1
# Support modern and intermediate browsers
# If you want to allow some older browsers add TLSv1 (but then you will need to review the ciphers below and use the OLD set of ciphers from Mozilla)
##
ssl_protocols TLSv1.2 TLSv1.3;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
##
# -----------
# SSL CIPHERS
# ciphers recommended by https://mozilla.github.io/server-side-tls/ssl-config-generator/
# -----------
# Ciphers below are the strongest and most recommened set as of 2019-07-04 (cipher recommendations change regularly)
# This is my own set of ciphers based on recommendations from https://www.immuniweb.com/ssl/
# and https://www.ssllabs.com/ssltest/
# You can optionally use ciphers recommended by https://mozilla.github.io/server-side-tls/ssl-config-generator/
# As we approach wider implementation and use of TLSv1.3 things will change even more
# As of this version and writing - Nginx does not support TLSv1.3 yet
##
##
# CIPHER COMPLIANCE
# ------------------------------------
# COMPLIANT to PCI DSS compliance
# COMPLIANT to HIPAA guidance
# COMPLIANT to NIST guidelines
# COMPLIANT to industry best practices
# ------------------------------------
##
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
# Enable modern TLS cipher suites - without ECDHE-RSA-CHACHA20-POLY1305 (POLY1305 is not recommended anymore)
# This cipher set is highly tested and supports modern and older clients without using weak ciphers of any sort
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
# TLSv1.2 only recommends this to be off
ssl_prefer_server_ciphers on;
##
# HSTS Headers
# HSTS (HTTP Strict Transport Security)
# https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
##
add_header Strict-Transport-Security max-age=63072000; includeSubDomains; preload; always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload; always;";
##
# OCSP Stapling
@ -110,11 +133,4 @@
# resolver 8.8.8.8 8.8.4.4 valid=300s;
# resolver_timeout 5s;
##
# HSTS(HTTP Strict Transport Security)
# https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
##
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;