From 89850317c810c81cad691cf8e4427b0673ffdce2 Mon Sep 17 00:00:00 2001
From: kballou <kballou@devnulllabs.io>
Date: Fri, 10 Feb 2017 14:17:34 -0700
Subject: Update ssl ciphers and add dhparams

---
 sites-available/blog | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sites-available/blog b/sites-available/blog
index a6ea85d..41bb39d 100644
--- a/sites-available/blog
+++ b/sites-available/blog
@@ -11,8 +11,12 @@ server {
     ssl_session_cache shared:SSL:1m;
     ssl_session_timeout 5m;
 
-    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
+
     ssl_prefer_server_ciphers on;
+
+    ssl_dhparam /etc/nginx/ssl/dhparams.pem;
+
     ssl_protocols TLSv1.2 TLSv1.1;
 
     root /srv/www/blog;
-- 
cgit v1.2.1