gaja-group
/
server-configs-nginx
mirror of https://github.com/h5bp/server-configs-nginx
2
0
Fork 0
Code Issues Releases Wiki Activity
server-configs-nginx/h5bp
History
Léo Colombaro 959839d81f Add a modern profile for SSL policy 
TLSv1.0 & TLSv1.1 suffer from [POODLE](blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls) and other [padding oracle attack](blog.cloudflare.com/padding-oracles-and-the-decline-of-cbc-mode-ciphersuites)
You need to support only TLSv1.2 to expect closing those weakness (and use only AEAD cipher suite in case of padding oracle).

The same, non PFS cipher suite is not at all recommended (see heartbleed effect).
DHE support [is dropped](digicert.com/blog/google-plans-to-deprecate-dhe-cipher-suites) from any decent user agent and can lead to [mitm attack](media.ccc.de/v/32c3-7288-logjam_diffie-hellman_discrete_logs_the_nsa_and_you#t=1357) (arround ~25min in the video) with only one side supporting weak cipher suite.
3DES is deprecated and suffer from [sweet32](sweet32.info)

So I recommend using only the `EECDH+CHACHA20:EECDH+AES` cipher suite, which has [quite good compatibility](cryptcheck.fr/suite/EECDH+CHACHA20:EECDH+AES) and a very better security than the actual cipher suite.

Fix #201
Fix #183
Fix #190
Prepare #180

Co-authored-by: aeris <aeris@users.noreply.github.com>
 		2018-11-29 10:39:33 +01:00
..
cross-origin Split directives to enforce atomic structure 2018-11-23 17:19:51 +01:00
errors Split directives to enforce atomic structure 2018-11-23 17:19:51 +01:00
internet_explorer Split directives to enforce atomic structure 2018-11-23 17:19:51 +01:00
location Merge #202 2018-11-27 21:43:18 +01:00
security Split SSL config 2018-11-29 10:39:33 +01:00
ssl Add a modern profile for SSL policy 2018-11-29 10:39:33 +01:00
web_performance Tweaks and lint 2018-11-25 22:07:01 +01:00
README.md Renamed h5bp.conf to basic.conf README 2013-12-03 23:50:27 +05:30
basic.conf Split directives to enforce atomic structure 2018-11-23 17:19:51 +01:00

README.md

Component-config files

Each of these files is intended to be included in a server block. Not all of the files here are used - they are available to be included as required. The basic.conf file includes the rules which are recommended to always be defined.