gaja-group
/
server-configs-nginx
mirror of https://github.com/h5bp/server-configs-nginx
2
0
Fork 0
Code Issues Releases Wiki Activity
250 Commits 2 Branches 12 Tags 1.2 MiB
Commit Graph

14 Commits

Author SHA1 Message Date
Chris McKee a97cbecd12 Update Cipher list to latest add version of STS 
Updated latest "intermediate" ciphers from mozilla
Add another version of the STS header including subdomains and comments
Add note at base to consider ssl-stapling
 2014-10-28 21:20:37 +00:00
Andy Dawson 764c707262 Merge pull request #69 from mikealmond/ssl-updates 
Updated SSL ciphers and added note about POODLE
 2014-10-17 21:06:10 +02:00
Daniel Marquard 99cdb58475 HSTS off by default 
Consensus to disable HSTS by default.
 2014-10-16 05:40:48 -04:00
Mike Almond 4cd1367b43 Remove quotes from SSL cipher list 2014-10-15 13:47:33 -04:00
Mike Almond fe256f3be7 Add note about POODLE attack against SSLv3 2014-10-15 11:22:09 -04:00
Mike Almond 25cbfb8942 Update SSL ciphers to the updated defaults by Mozilla 2014-10-15 11:17:04 -04:00
Daniel Marquard 5525eebf2b Removed "includeSubDomains" 
As a best practice, Nginx should only direct clients to use the certificate on specified domains. This is because not all servers using other subdomains necessarily listen on 443 and because, unless it is a wildcard certificate, it likely won't be valid on subdomains other than WWW.
 2014-10-14 00:16:22 -04:00
AD7six 332998a2db use a much longer ssl_session_timeout 
To match the settiongs from istlsfastyet.com

Add a mention of ssl_buffer_size even though it can 't be enabled yet
 2014-07-28 14:56:27 +00:00
AD7six 72f9509a5e disable ssl_session_tickets 
it's only recently added so is a config error otherwise
 2014-07-28 14:42:35 +00:00
AD7six 759bf84163 Default to use HTTP strict transport security 2014-07-28 14:30:00 +00:00
AD7six 398036440b add increased ssl timeout 2014-07-28 14:29:04 +00:00
AD7six d996d2da0c turn off ssl session tickets 
Stolen from istlsfastyet.com's config

It is probably a more logical default to turn off session tickets
given the diff linked in the comment block.
 2014-07-28 14:20:58 +00:00
AD7six 08d4bbbd04 remove SSLv3 from the ssl protocol list 
As suggested in #44, and since h5bp doesn't support IE6 it seems to be
appropriate to remove a protocol which is in the list only to permit use
with IE6.
 2014-07-28 14:16:09 +00:00
AD7six 029ff47286 move ssl config to a seperate file 2014-07-28 14:08:19 +00:00