Merge branch 'feature/split-ssl'

Add ssl config from istlsfastyet.com

Some doc changes needed, but this includes all of the config changes

Closes #44

h5bp/directive-only/spdy.conf

@@ -0,0 +1,7 @@
+# Nginx's spdy module is currently experimental
+
+# Adjust connection keepalive for SPDY clients:
+spdy_keepalive_timeout 300; # up from 180 secs default
+
+# enable SPDY header compression
+spdy_headers_comp 6;

h5bp/directive-only/ssl-stapling.conf

@@ -0,0 +1,5 @@
+# OCSP stapling...
+ssl_stapling on;
+ssl_stapling_verify on;
+#ssl_trusted_certificate /path/to/ca.crt;
+resolver 8.8.8.8;

h5bp/directive-only/ssl.conf

@@ -0,0 +1,39 @@
+# Protect against the BEAST attack by not using SSLv3 at all. If you need to support older browsers (IE6) you may need to add
+# SSLv3 to the list of protocols below.
+ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;
+
+# Ciphers set to best allow protection from Beast, while providing forwarding secrecy, as defined by Mozilla - https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx
+ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
+ssl_prefer_server_ciphers  on;
+
+# Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes.
+# The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection.
+# By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state.
+# Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS.
+ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
+ssl_session_timeout  24h;
+
+# SSL buffer size was added in 1.5.9
+#ssl_buffer_size      1400; # 1400 bytes to fit in one MTU
+
+# Session tickets appeared in version 1.5.9
+#
+# nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
+# when a restart is performed the previous key is lost, which resets all previous
+# sessions. The fix for this is to setup a manual rotation mechanism:
+# http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
+#
+# Note that you'll have to define and rotate the keys securely by yourself. In absence
+# of such infrastructure, consider turning off session tickets:
+#ssl_session_tickets off;
+
+# Use a higher keepalive timeout to reduce the need for repeated handshakes
+keepalive_timeout 300; # up from 75 secs default
+
+# remember the certificate for a year and automatically connect to HTTPS
+add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
+
+# This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication).
+# Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors.
+#ssl_certificate      /etc/nginx/default_ssl.crt;
+#ssl_certificate_key  /etc/nginx/default_ssl.key;

nginx.conf

@@ -118,24 +118,5 @@ http {
   # a specific directory, or on an individual server{} level.
   # gzip_static on;
 
-  # Protect against the BEAST attack by preferring RC4-SHA when using SSLv3 and TLS protocols.
-  # Note that TLSv1.1 and TLSv1.2 are immune to the beast attack but only work with OpenSSL v1.0.1 and higher and has limited client support.
-  # Ciphers set to best allow protection from Beast, while providing forwarding secrecy, as defined by Mozilla - https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx
-  ssl_protocols              SSLv3 TLSv1 TLSv1.1 TLSv1.2;
-  ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
-  ssl_prefer_server_ciphers  on;
-
-  # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes.
-  # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection.
-  # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state.
-  # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS.
-  ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
-  ssl_session_timeout  10m;
-
-  # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication).
-  # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors.
-  #ssl_certificate      /etc/nginx/default_ssl.crt;
-  #ssl_certificate_key  /etc/nginx/default_ssl.key;
-
   include sites-enabled/*;
 }

sites-available/ssl.example.com

@@ -0,0 +1,48 @@
+# Choose between www and non-www, listen on the *wrong* one and redirect to
+# the right one -- http://wiki.nginx.org/Pitfalls#Server_Name
+#
+server {
+  listen 80;
+
+  # listen on both hosts
+  server_name example.com www.example.com;
+
+  include h5bp/direcive-only/ssl.conf
+
+  # and redirect to the https host (declared below)
+  # avoiding http://www -> https://www -> https:// chain.
+  return 301 https://example.com$request_uri;
+}
+
+server {
+  listen 443 ssl spdy;
+
+  # listen on the wrong host
+  server_name www.example.com;
+
+  include h5bp/direcive-only/ssl.conf
+
+  # and redirect to the non-www host (declared below)
+  return 301 https://example.com$request_uri;
+}
+
+server {
+  listen 443 ssl spdy;
+
+  # The host name to respond to
+  server_name example.com;
+
+  include h5bp/direcive-only/ssl.conf
+
+  # Path for static files
+  root /sites/example.com/public;
+
+  #Specify a charset
+  charset utf-8;
+
+  # Custom 404 page
+  error_page 404 /404.html;
+
+  # Include the basic h5bp config set
+  include h5bp/basic.conf;
+}