From 5f80cd3c2048dd5f9262cbf1303543998985755a Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 15 Sep 2019 22:24:37 -0400 Subject: [PATCH] feat: follow updated intermediate recommendations from the Mozilla SSL Config Generator --- plugins/nginx-vhosts/install | 4 ++-- plugins/nginx-vhosts/templates/nginx.conf.sigil | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index c4759671d..02cdc8c25 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -43,9 +43,9 @@ include $DOKKU_ROOT/*/nginx.conf; server_tokens off; # Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/ -ssl_session_cache shared:SSL:20m; +ssl_session_cache shared:SSL:20m; ssl_session_timeout 1d; -ssl_session_tickets on; +ssl_session_tickets off; ssl_dhparam /etc/nginx/dhparam.pem; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil index 3d1557cf4..04db4383c 100644 --- a/plugins/nginx-vhosts/templates/nginx.conf.sigil +++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil @@ -63,10 +63,10 @@ server { access_log /var/log/nginx/{{ $.APP }}-access.log; error_log /var/log/nginx/{{ $.APP }}-error.log; - ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; - ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; - ssl_protocols TLSv1.2; - ssl_prefer_server_ciphers on; + ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; + ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; keepalive_timeout 70; {{ if and (eq $.SPDY_SUPPORTED "true") (ne $.HTTP2_SUPPORTED "true") }}add_header Alternate-Protocol {{ $.PROXY_SSL_PORT }}:npn-spdy/2;{{ end }} @@ -140,10 +140,10 @@ server { access_log /var/log/nginx/{{ $.APP }}-access.log; error_log /var/log/nginx/{{ $.APP }}-error.log; - ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; - ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; - ssl_protocols TLSv1.2; - ssl_prefer_server_ciphers on; + ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; + ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; location / { grpc_pass grpc://{{ $.APP }}-{{ $upstream_port }};