From e418b5a34264b30d28fd739138d1e7bbd98f639e Mon Sep 17 00:00:00 2001 From: root Date: Wed, 9 Nov 2022 11:51:37 -0500 Subject: [PATCH] fix ssl shit --- conf.d/0x0.conf | 9 +++++++-- conf.d/cryptpad.conf | 11 ----------- conf.d/mirror.conf | 8 +++++++- snippets/headers.conf | 6 ------ snippets/lets-encrypt.conf | 16 +++++++++++++++- 5 files changed, 29 insertions(+), 21 deletions(-) diff --git a/conf.d/0x0.conf b/conf.d/0x0.conf index 4ded9dd..dba13bd 100644 --- a/conf.d/0x0.conf +++ b/conf.d/0x0.conf @@ -23,9 +23,14 @@ server { listen [::]:80; server_name 0.vern.cc; - include snippets/lets-encrypt.conf; - include snippets/headers.conf; include common/0x0.conf; + ssl_certificate_key /etc/letsencrypt/live/vern.cc/privkey.pem; + ssl_certificate /etc/letsencrypt/live/vern.cc/fullchain.pem; + ssl_dhparam /etc/letsencrypt/live/vern.cc/dhparam; + # intermediate configuration + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; } server { diff --git a/conf.d/cryptpad.conf b/conf.d/cryptpad.conf index 9181766..9695169 100644 --- a/conf.d/cryptpad.conf +++ b/conf.d/cryptpad.conf @@ -62,17 +62,6 @@ server { # that includes both domains in order for things to work as expected. include snippets/lets-encrypt.conf; # Speeds things up a little bit when resuming a session - ssl_session_timeout 5m; - ssl_session_cache shared:SSL:5m; - - # You'll need nginx 1.13.0 or better to support TLSv1.3 - ssl_protocols TLSv1.2 TLSv1.3; - - # https://cipherli.st/ - ssl_ciphers EECDH+AESGCM:EDH+AESGCM; - ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 - - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options nosniff; add_header Access-Control-Allow-Origin "${allowed_origins}"; diff --git a/conf.d/mirror.conf b/conf.d/mirror.conf index 8ca8969..a6dec39 100644 --- a/conf.d/mirror.conf +++ b/conf.d/mirror.conf @@ -29,7 +29,13 @@ server { listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; - include snippets/lets-encrypt.conf; + ssl_certificate_key /etc/letsencrypt/live/vern.cc/privkey.pem; + ssl_certificate /etc/letsencrypt/live/vern.cc/fullchain.pem; + ssl_dhparam /etc/letsencrypt/live/vern.cc/dhparam; + # intermediate configuration + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; include snippets/headers.conf; server_name mirror.vern.cc mirrors.vern.cc; diff --git a/snippets/headers.conf b/snippets/headers.conf index f60666c..2ac7096 100644 --- a/snippets/headers.conf +++ b/snippets/headers.conf @@ -1,12 +1,6 @@ -add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; #add_header Content-Security-Policy "default-src 'self'; font-src 'self'; img-src 'self' https://i.creativecommons.org/ https://licensebuttons.net/; style-src 'self' 'unsafe-inline'" always; add_header X-Frame-Options "SAMEORIGIN" always; -ssl_stapling on; -ssl_stapling_verify on; # intermediate configuration -ssl_protocols TLSv1.2 TLSv1.3; -ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; -ssl_prefer_server_ciphers off; add_header Referrer-Policy "same-origin" always; diff --git a/snippets/lets-encrypt.conf b/snippets/lets-encrypt.conf index 4e83bb4..14dbc82 100644 --- a/snippets/lets-encrypt.conf +++ b/snippets/lets-encrypt.conf @@ -6,6 +6,20 @@ ssl_dhparam /etc/letsencrypt/live/vern.cc/dhparam; # verify chain of trust of OCSP response using Root CA and Intermediate certs # ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates; +ssl_session_timeout 1d; +ssl_session_cache shared:MozSSL:10m; # about 40000 sessions +ssl_session_tickets off; +# intermediate configuration +ssl_protocols TLSv1.2 TLSv1.3; +ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384; +ssl_prefer_server_ciphers off; + +# HSTS (ngx_http_headers_module is required) (63072000 seconds) +add_header Strict-Transport-Security "max-age=63072000" always; + +# OCSP stapling +ssl_stapling on; +ssl_stapling_verify on; # replace with the IP address of your resolver -resolver 213.186.33.99; +resolver 173.255.236.85;