26 lines
5.0 KiB
JSON
26 lines
5.0 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"saved_at": "2026-08-07T04:17:21.1844656Z",
|
|
"content_sha256": "896265d47e83c3cc6605ee31bfb143818e4f16cca4985b4db7884610238f0277",
|
|
"result": {
|
|
"title": "Nginx Perfect TLS Configuration 2026 · GitHub",
|
|
"url": "https://gist.github.com/giovanni-orciuolo/616527f1f01e70b3a026da0d56fe9f1d",
|
|
"snippet": "Please keep in mind that, if you have multiple configurations running on Nginx, all of them must use TLSv1.3 for it to work.",
|
|
"content": "Instantly share code, notes, and snippets.\n\ngiovanni-orciuolo / https.conf\n\nCreated\nJanuary 8, 2026 10:28\n\nShow Gist options\n\nDownload ZIP\n\nStar\n\n( 0 )\n\nYou must be signed in to star a gist\n\nFork\n\n( 0 )\n\nYou must be signed in to fork a gist\n\nEmbed\n\nSelect an option\n\nEmbed\nEmbed this gist in your website.\n\nShare\nCopy sharable link for this gist.\n\nClone via HTTPS\nClone using the web URL.\n\nNo results found\n\nLearn more about clone URLs\n\nClone this repository at \u0026lt;script src=\u0026quot;https://gist.github.com/giovanni-orciuolo/616527f1f01e70b3a026da0d56fe9f1d.js\u0026quot;\u0026gt;\u0026lt;/script\u0026gt;\n\nSave giovanni-orciuolo/616527f1f01e70b3a026da0d56fe9f1d to your computer and use it in GitHub Desktop.\n\nEmbed\n\nSelect an option\n\nEmbed\nEmbed this gist in your website.\n\nShare\nCopy sharable link for this gist.\n\nClone via HTTPS\nClone using the web URL.\n\nNo results found\n\nLearn more about clone URLs\n\nClone this repository at \u0026lt;script src=\u0026quot;https://gist.github.com/giovanni-orciuolo/616527f1f01e70b3a026da0d56fe9f1d.js\u0026quot;\u0026gt;\u0026lt;/script\u0026gt;\n\nSave giovanni-orciuolo/616527f1f01e70b3a026da0d56fe9f1d to your computer and use it in GitHub Desktop.\n\nDownload ZIP\n\nNginx Perfect TLS Configuration 2026\n\nRaw\n\nhttps.conf\n\nThis file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.\nLearn more about bidirectional Unicode characters\n\nShow hidden characters\n\n# Only return Nginx in server header\n\nserver_tokens off;\n\n# Enable Perfect Forward Secrecy (PFS)\n\nssl_dhparam dh4096.pem;\n\nssl_protocols TLSv1.2 TLSv1.3;\n\n# Compilation of the top cipher suites 2026\n\n# https://ssl-config.mozilla.org/#server=nginx\n\nssl_ecdh_curve X25519:prime256v1:secp384r1;\n\nssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;\n\n# Perfect Forward Secrecy (PFS) is frequently compromised without this\n\nssl_prefer_server_ciphers on;\n\nssl_session_tickets off;\n\n# Enable SSL session caching for improved performance\n\nssl_session_timeout 1d;\n\nssl_session_cache shared:SSL:10m;\n\n# By default, the buffer size is 16k, which corresponds to minimal overhead when sending big responses.\n\n# To minimize Time To First Byte it may be beneficial to use smaller values\n\nssl_buffer_size 8k;\n\n# OCSP stapling\n\nssl_stapling on;\n\nssl_stapling_verify on;\n\n# Security headers\n\n## X-Content-Type-Options: avoid MIME type sniffing\n\nadd_header X-Content-Type-Options nosniff;\n\n## Content-Security-Policy (CSP): Yes\n\n## No 'script-src' directive, you need to test it yourself\n\nadd_header Content-Security-Policy \"object-src 'none'; base-uri 'none'; require-trusted-types-for 'script'; frame-ancestors 'self';\";\n\n## The safest CSP, only block your website to be inside an iframe\n\n# add_header Content-Security-Policy \"frame-ancestors 'self';\";\n\n## Strict Transport Security (HSTS): Yes\n\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubdomains; preload\";\n\ngiovanni-orciuolo\n\ncommented\n\nJan 8, 2026\n\nCopy link\n\nCopy Markdown\n\nAuthor\n\nPlease keep in mind that, if you have multiple configurations running on Nginx, all of them must use TLSv1.3 for it to work .\n\ngiovanni-orciuolo\n\ncommented\n\nJan 9, 2026\n\nCopy link\n\nCopy Markdown\n\nAuthor\n\nNote to self: CSP base-uri 'none' line might break some configurations which are based on routing through the base-uri (e.g. subdomains)\n\nSign up for free\nto join this conversation on GitHub .\nAlready have an account?\nSign in to comment",
|
|
"content_type": "text/html",
|
|
"query": "What configuration parameters are required for Perfect Forward Secrecy in Nginx?",
|
|
"language": "en-US",
|
|
"round": 3,
|
|
"fetched": true,
|
|
"relevant": true,
|
|
"relevance": 0.99,
|
|
"source_quality": "primary",
|
|
"source_quality_score": 0.904,
|
|
"actionable": true,
|
|
"covered_gap_ids": [
|
|
"G1"
|
|
],
|
|
"assessment_reason": "The source provides specific configuration parameters for Perfect Forward Secrecy in Nginx, including ssl_dhparam, ssl_protocols, ssl_ciphers, and ssl_prefer_server_ciphers. These are directly relevant to the question and include actionable steps for implementation."
|
|
}
|
|
}
|