Nginx SSL 配置

# 生成于2025-03-25，Mozilla指南v5.7，nginx 1.27.3，OpenSSL 3.4.0，中间配置
# https://ssl-config.mozilla.org/#server=nginx&version=1.27.3&config=intermediate&openssl=3.4.0&guideline=5.7

http {

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;
        ssl_certificate /path/to/signed_cert_plus_intermediates;  # SSL证书路径
        ssl_certificate_key /path/to/private_key;  # 私钥路径

        # HSTS（需要ngx_http_headers_module模块）（63072000秒）
        add_header Strict-Transport-Security "max-age=63072000" always;
    }

    # 中间配置
    ssl_protocols TLSv1.2 TLSv1.3;  # 支持的SSL协议版本
    ssl_ecdh_curve X25519:prime256v1:secp384r1;  # 支持的椭圆曲线
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;  # 支持的加密套件
    ssl_prefer_server_ciphers off;  # 不优先使用服务器端的加密套件

    # 另见ssl_session_ticket_key作为有状态会话缓存的替代方案
    ssl_session_timeout 1d;  # SSL会话超时时间
    ssl_session_cache shared:MozSSL:10m;  # 大约40000个会话

    # 运行以下命令生成dhparam文件：curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
    ssl_dhparam "/path/to/dhparam";  # DH参数文件路径

    # OCSP装订
    ssl_stapling on;  # 开启OCSP装订
    ssl_stapling_verify on;  # 验证OCSP装订

    # 使用根CA证书和中间证书验证OCSP响应的信任链
    ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;  # 根CA证书和中间证书路径

    # 替换为您的解析器IP地址；
    # 异步的'resolver'对于OCSP装订的正常运行非常重要
    resolver 127.0.0.1;

    # 如果证书标记为OCSP Must-Staple，考虑使用外部脚本管理OCSP装订缓存，例如certbot-ocsp-fetcher

    # HSTS
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        return 301 https://$host$request_uri;  # 将HTTP请求重定向到HTTPS
    }
}