diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install
index 8b4d53217..97d206c2e 100755
--- a/plugins/nginx-vhosts/install
+++ b/plugins/nginx-vhosts/install
@@ -33,10 +33,13 @@ include $DOKKU_ROOT/*/nginx.conf;
 
 server_tokens off;
 
+# Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/
 ssl_session_cache shared:SSL:20m;
-ssl_session_timeout 10m;
+ssl_session_timeout 1d;
+ssl_protocols TLSv1.2;
+ssl_prefer_server_ciphers on;
 
-ssl_ciphers EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
 
 EOF
 fi
diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil
index 6638afe37..d1c6bb468 100644
--- a/plugins/nginx-vhosts/templates/nginx.conf.sigil
+++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil
@@ -47,7 +47,7 @@ server {
 
   ssl_certificate     {{ $.APP_SSL_PATH }}/server.crt;
   ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key;
-  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+  ssl_protocols       TLSv1.2;
 
   keepalive_timeout   70;
   {{ if eq $.SPDY_SUPPORTED "true" }}add_header          Alternate-Protocol  {{ $.NGINX_SSL_PORT }}:npn-spdy/2;{{ end }}