From 90e85782473870c216efc601227d1fde7ff86f04 Mon Sep 17 00:00:00 2001
From: Mitchell Krog <mitchellkrog@gmail.com>
Date: Thu, 4 Jul 2019 13:23:16 +0200
Subject: [PATCH] UPDATE ssl.d/globalssl.conf [ci skip]

Recommended SSL settings for all nginx sites
---
 ssl.d/globalssl.conf | 46 +++++++++++++++++++++++++++++---------------
 1 file changed, 31 insertions(+), 15 deletions(-)

diff --git a/ssl.d/globalssl.conf b/ssl.d/globalssl.conf
index d732a592f..4fde985a6 100644
--- a/ssl.d/globalssl.conf
+++ b/ssl.d/globalssl.conf
@@ -54,7 +54,7 @@
 # include /etc/nginx/ssl.d/globalssl.conf;
 
 
-    ## 
+   ## 
     # DIFFIE HELMAN ENCRYPTION / DHE
     ##
 
@@ -78,24 +78,47 @@
 
     ##
     # SSL PROTOCOL SUPPORT
-    # Support modern and intermediate browsers ONLY 
-    # If you want to allow some older browsers add TLSv1 TLSv1.1 
+    # Support modern and intermediate browsers
+    # If you want to allow some older browsers add TLSv1 (but then you will need to review the ciphers below and use the OLD set of ciphers from Mozilla)
     ##
 
-	ssl_protocols TLSv1.2 TLSv1.3;
+	ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
 
     ##
+    # -----------
     # SSL CIPHERS 
-    # ciphers recommended by https://mozilla.github.io/server-side-tls/ssl-config-generator/
+    # -----------
+    # Ciphers below are the strongest and most recommened set as of 2019-07-04 (cipher recommendations change regularly)
+    # This is my own set of ciphers based on recommendations from https://www.immuniweb.com/ssl/
+    # and https://www.ssllabs.com/ssltest/
+    # You can optionally use ciphers recommended by https://mozilla.github.io/server-side-tls/ssl-config-generator/
+    # As we approach wider implementation and use of TLSv1.3 things will change even more
+    # As of this version and writing - Nginx does not support TLSv1.3 yet
+    ##
+    
+    ##
+    # CIPHER COMPLIANCE
+    # ------------------------------------
+    # COMPLIANT to PCI DSS compliance
+    # COMPLIANT to HIPAA guidance
+    # COMPLIANT to NIST guidelines
+    # COMPLIANT to industry best practices
+    # ------------------------------------
+    ##    
 
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+	# Enable modern TLS cipher suites - without ECDHE-RSA-CHACHA20-POLY1305 (POLY1305 is not recommended anymore)
+	# This cipher set is highly tested and supports modern and older clients without using weak ciphers of any sort
+	ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+
+	# TLSv1.2 only recommends this to be off
 	ssl_prefer_server_ciphers on;
 
     ##
-    # HSTS Headers
+    # HSTS (HTTP Strict Transport Security)
+    # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
     ##
 
-    add_header Strict-Transport-Security max-age=63072000; includeSubDomains; preload; always;
+	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload; always;";
 
     ##
     # OCSP Stapling
@@ -110,11 +133,4 @@
   	# resolver 8.8.8.8 8.8.4.4 valid=300s;
   	# resolver_timeout 5s;
 
-    ##
-    # HSTS(HTTP Strict Transport Security)
-    # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
-    ##
-
-	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-