Improve: TLS recommended configuration

AnYiEE · Apr 27, 2023 · 75962b6 · 75962b6
1 parent 9ca5c4a
commit 75962b6
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/nginx.conf b/nginx.conf
@@ -24,8 +24,11 @@ http {
         proxy_buffer_size            128k;
         proxy_busy_buffers_size      256k;
 
-        ssl_stapling         on;
-        ssl_stapling_verify  on;
+        ssl_ciphers                TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA;
+        ssl_protocols              TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers  on;
+        ssl_stapling               on;
+        ssl_stapling_verify        on;
 
         include  /path/to/wikimirror/conf/wiki.nginx;
 }