MadFaill · December 11, 2018 10:46 · Oct 9, 2015 · Feb 20, 2015 · Feb 20, 2015 · Feb 5, 2015
diff --git a/site.conf b/site.conf
@@ -65,6 +65,7 @@ server {
 
         # enabling Public Key Pinning Extension for HTTP (HPKP)
         # https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning
+        # tool for checking and generating proper certificates: https://report-uri.io/home/tools
         # to generate use on of these:
         # $ openssl rsa  -in my-website.key -outform der -pubout | openssl dgst -sha256 -binary | base64
         # $ openssl req  -in my-website.csr -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64

diff --git a/site.conf b/site.conf
@@ -1,6 +1,8 @@
 # read more at https://terrty.net/2014/ssl-tls-in-nginx/
 # latest version on https://gist.github.com/paskal/628882bee1948ef126dd/126e4d1daeb5244aacbbd847c5247c2e293f6adf
 # security test score: https://www.ssllabs.com/ssltest/analyze.html?d=terrty.net
+# your nginx version might not have all directives included, test this configuration before using in production against your nginx:
+# $ nginx -c /etc/nginx/nginx.conf -t
 
 server {
         # public key, contains your public key and class 1 certificate, to create:

diff --git a/site.conf b/site.conf
@@ -4,8 +4,8 @@
 
 server {
         # public key, contains your public key and class 1 certificate, to create:
-        # (exapmle for startssl)
-        # $ cat example.com.pem sub.class1.server.ca.pem > /etc/nginx/ssl/domain.pem
+        # (example for startssl)
+        # $ (cat example.com.pem & wget -O - https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem) | tee -a /etc/nginx/ssl/domain.pem > /dev/null
         ssl_certificate /etc/nginx/ssl/domain.pem;
 
         # private key (decoded), decode encoded with RSA key with command:
@@ -39,7 +39,7 @@ server {
         # dns resolver, we're using Google IPv4 and IPv6 servers
         resolver 8.8.8.8 [2001:4860:4860::8888];
         # verify chain of trust of OCSP response using Root CA and Intermediate certs, example for StartSSL:
-        # $ wget -O - https://www.startssl.com/certs/ca.pem https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem | tee -a ca-certs.pem> /dev/null
+        # $ wget -O - https://www.startssl.com/certs/ca.pem https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem | tee -a ca-certs.pem > /dev/null
         ssl_trusted_certificate /etc/nginx/ssl/root_CA_cert_plus_intermediates;
 
         # consider turning 'deferred' off on old versions of nginx if you occur any problems

diff --git a/site.conf b/site.conf
@@ -58,7 +58,7 @@ server {
 
         # enabling HSTS(HTTP Strict Transport Security)
         # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
-        add_header Strict-Transport-Security 'max-age=31536000';
+        add_header Strict-Transport-Security 'max-age=31536000' always;
 
 
         # enabling Public Key Pinning Extension for HTTP (HPKP)
@@ -67,7 +67,7 @@ server {
         # $ openssl rsa  -in my-website.key -outform der -pubout | openssl dgst -sha256 -binary | base64
         # $ openssl req  -in my-website.csr -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64
         # $ openssl x509 -in my-website.crt -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64
-        add_header Public-Key-Pins 'pin-sha256="base64+info1="; max-age=31536000; includeSubDomains';
+        add_header Public-Key-Pins 'pin-sha256="base64+info1="; max-age=31536000' always;
 
 
         # config to don't allow the browser to render the page inside an frame or

diff --git a/site.conf b/site.conf
@@ -58,7 +58,7 @@ server {
 
         # enabling HSTS(HTTP Strict Transport Security)
         # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
-        add_header Strict-Transport-Security max-age=31536000;
+        add_header Strict-Transport-Security 'max-age=31536000';
 
 
         # enabling Public Key Pinning Extension for HTTP (HPKP)

diff --git a/site.conf b/site.conf
@@ -20,8 +20,10 @@ server {
         # don't forget to set secure rights to these files:
         # $ chmod 400 /etc/nginx/ssl/*
 
-        ssl_session_cache shared:SSL:50m;
-        ssl_session_timeout 5m;
+        # http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+        # make it bigger for more sessions, one megabyte for ~ 4000 session
+        ssl_session_cache shared:SSL:100m;
+        ssl_session_timeout 60m;
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
         # ciphers are latest modern from https://wiki.mozilla.org/Security/Server_Side_TLS (only place you can trust on web)
@@ -40,6 +42,7 @@ server {
         # $ wget -O - https://www.startssl.com/certs/ca.pem https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem | tee -a ca-certs.pem> /dev/null
         ssl_trusted_certificate /etc/nginx/ssl/root_CA_cert_plus_intermediates;
 
+        # consider turning 'deferred' off on old versions of nginx if you occur any problems
         listen 443 deferred spdy ssl;
         listen [::]:443 deferred spdy ssl ipv6only=on;
         server_name example.com;
@@ -55,7 +58,7 @@ server {
 
         # enabling HSTS(HTTP Strict Transport Security)
         # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
-        add_header Strict-Transport-Security max-age=31536000 always;
+        add_header Strict-Transport-Security max-age=31536000;
 
 
         # enabling Public Key Pinning Extension for HTTP (HPKP)
@@ -71,6 +74,7 @@ server {
         # iframe and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
         # if you need to allow [i]frames, you can use SAMEORIGIN
         # or set an uri with ALLOW-FROM uri
+        # warning, this option breaking some analitics tools
         add_header X-Frame-Options DENY;
 
         # when serving user-supplied content, include a
@@ -85,6 +89,7 @@ server {
         add_header X-XSS-Protection "1; mode=block";
 
         location / {
+                # try_files might be dangerous, please read: http://blog.volema.com/nginx-insecurities.html
                 try_files $uri $uri/ =404;
         }
 

diff --git a/site.conf b/site.conf
@@ -34,7 +34,8 @@ server {
         # fetch OCSP records from URL in ssl_certificate and cache them
         ssl_stapling on;
         ssl_stapling_verify on;
-        resolver 8.8.8.8;
+        # dns resolver, we're using Google IPv4 and IPv6 servers
+        resolver 8.8.8.8 [2001:4860:4860::8888];
         # verify chain of trust of OCSP response using Root CA and Intermediate certs, example for StartSSL:
         # $ wget -O - https://www.startssl.com/certs/ca.pem https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem | tee -a ca-certs.pem> /dev/null
         ssl_trusted_certificate /etc/nginx/ssl/root_CA_cert_plus_intermediates;

diff --git a/site.conf b/site.conf
@@ -22,7 +22,7 @@ server {
 
         ssl_session_cache shared:SSL:50m;
         ssl_session_timeout 5m;
-        ssl_protocols TSLv1.0 TLSv1.1 TLSv1.2;
+        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
         # ciphers are latest modern from https://wiki.mozilla.org/Security/Server_Side_TLS (only place you can trust on web)
         # working example:

diff --git a/site.conf b/site.conf
@@ -22,10 +22,12 @@ server {
 
         ssl_session_cache shared:SSL:50m;
         ssl_session_timeout 5m;
-        ssl_protocols TLSv1.1 TLSv1.2;
+        ssl_protocols TSLv1.0 TLSv1.1 TLSv1.2;
 
         # ciphers are latest modern from https://wiki.mozilla.org/Security/Server_Side_TLS (only place you can trust on web)
-        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';       
+        # working example:
+        # ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DES';       
+        ssl_ciphers '<paste intermediate ciphersuite here>';
         ssl_prefer_server_ciphers on;
 
         # OCSP Stapling ---

diff --git a/site.conf b/site.conf
@@ -20,13 +20,12 @@ server {
         # don't forget to set secure rights to these files:
         # $ chmod 400 /etc/nginx/ssl/*
 
-        ssl_session_cache shared:SSL:10m;
+        ssl_session_cache shared:SSL:50m;
         ssl_session_timeout 5m;
-        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+        ssl_protocols TLSv1.1 TLSv1.2;
 
-        # ciphers based on https://wiki.mozilla.org/Security/Server_Side_TLS
-        # and on https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
-        ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DES";
+        # ciphers are latest modern from https://wiki.mozilla.org/Security/Server_Side_TLS (only place you can trust on web)
+        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';       
         ssl_prefer_server_ciphers on;
 
         # OCSP Stapling ---

diff --git a/site.conf b/site.conf
@@ -33,9 +33,10 @@ server {
         # fetch OCSP records from URL in ssl_certificate and cache them
         ssl_stapling on;
         ssl_stapling_verify on;
-        ## verify chain of trust of OCSP response using Root CA and Intermediate certs
-        ssl_trusted_certificate /etc/nginx/ssl/root_CA_cert_plus_intermediates;
         resolver 8.8.8.8;
+        # verify chain of trust of OCSP response using Root CA and Intermediate certs, example for StartSSL:
+        # $ wget -O - https://www.startssl.com/certs/ca.pem https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem | tee -a ca-certs.pem> /dev/null
+        ssl_trusted_certificate /etc/nginx/ssl/root_CA_cert_plus_intermediates;
 
         listen 443 deferred spdy ssl;
         listen [::]:443 deferred spdy ssl ipv6only=on;

diff --git a/site.conf b/site.conf
@@ -29,9 +29,13 @@ server {
         ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DES";
         ssl_prefer_server_ciphers on;
 
-        resolver 8.8.8.8;
+        # OCSP Stapling ---
+        # fetch OCSP records from URL in ssl_certificate and cache them
         ssl_stapling on;
-        ssl_trusted_certificate /etc/nginx/ssl/ca.pem;
+        ssl_stapling_verify on;
+        ## verify chain of trust of OCSP response using Root CA and Intermediate certs
+        ssl_trusted_certificate /etc/nginx/ssl/root_CA_cert_plus_intermediates;
+        resolver 8.8.8.8;
 
         listen 443 deferred spdy ssl;
         listen [::]:443 deferred spdy ssl ipv6only=on;

diff --git a/site.conf b/site.conf
@@ -51,7 +51,7 @@ server {
         add_header Strict-Transport-Security max-age=31536000 always;
 
 
-        # enabling Public Key Pinning
+        # enabling Public Key Pinning Extension for HTTP (HPKP)
         # https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning
         # to generate use on of these:
         # $ openssl rsa  -in my-website.key -outform der -pubout | openssl dgst -sha256 -binary | base64

diff --git a/site.conf b/site.conf
@@ -50,6 +50,16 @@ server {
         # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
         add_header Strict-Transport-Security max-age=31536000 always;
 
+
+        # enabling Public Key Pinning
+        # https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning
+        # to generate use on of these:
+        # $ openssl rsa  -in my-website.key -outform der -pubout | openssl dgst -sha256 -binary | base64
+        # $ openssl req  -in my-website.csr -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64
+        # $ openssl x509 -in my-website.crt -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64
+        add_header Public-Key-Pins 'pin-sha256="base64+info1="; max-age=31536000; includeSubDomains';
+
+
         # config to don't allow the browser to render the page inside an frame or
         # iframe and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
         # if you need to allow [i]frames, you can use SAMEORIGIN

diff --git a/site.conf b/site.conf
@@ -35,7 +35,7 @@ server {
 
         listen 443 deferred spdy ssl;
         listen [::]:443 deferred spdy ssl ipv6only=on;
-        server_name terrty.net;
+        server_name example.com;
         root /var/local/www/example;
         index index.html;
         autoindex off;

diff --git a/site.conf b/site.conf
@@ -1,4 +1,5 @@
 # read more at https://terrty.net/2014/ssl-tls-in-nginx/
+# latest version on https://gist.github.com/paskal/628882bee1948ef126dd/126e4d1daeb5244aacbbd847c5247c2e293f6adf
 # security test score: https://www.ssllabs.com/ssltest/analyze.html?d=terrty.net
 
 server {
@@ -35,7 +36,7 @@ server {
         listen 443 deferred spdy ssl;
         listen [::]:443 deferred spdy ssl ipv6only=on;
         server_name terrty.net;
-        root /var/local/octopress/public;
+        root /var/local/www/example;
         index index.html;
         autoindex off;
         charset utf-8;

diff --git a/gistfile1.sh b/gistfile1.sh
@@ -1,2 +0,0 @@
-# to generate your dhparam.pem file, run in the terminal
-openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

diff --git a/nginx.conf b/nginx.conf
@@ -1,77 +0,0 @@
-#read more here http://tautt.com/best-nginx-configuration-for-security/
-
-#don't send the nginx version number in error pages and Server header
-server_tokens off;
-
-# config to don't allow the browser to render the page inside an frame or iframe
-# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
-# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
-# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
-add_header X-Frame-Options SAMEORIGIN;
-
-# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
-# to disable content-type sniffing on some browsers.
-# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
-# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
-# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
-# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
-add_header X-Content-Type-Options nosniff;
-
-# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
-# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for 
-# this particular website if it was disabled by the user.
-# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
-add_header X-XSS-Protection "1; mode=block";
-
-# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
-# you can tell the browser that it can only download content from the domains you explicitly allow
-# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
-# https://www.owasp.org/index.php/Content_Security_Policy
-# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
-# directives for css and js(if you have inline css or js, you will need to keep it too).
-# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
-add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
-
-server {
-  listen 443 ssl default deferred;
-  server_name .forgott.com;
-
-  ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
-  ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
-
-  # enable session resumption to improve https performance
-  # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
-  ssl_session_cache shared:SSL:50m;
-  ssl_session_timeout 5m;
-
-  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
-  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
-
-  # enables server-side protection from BEAST attacks
-  # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
-  ssl_prefer_server_ciphers on;
-  # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
-  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-  # ciphers chosen for forward secrecy and compatibility
-  # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
-  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
-
-  # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
-  # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
-  resolver 8.8.8.8;
-  ssl_stapling on;
-  ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
-
-  # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
-  # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
-  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
-
-  #... the rest of your configuration
-}
-
-# redirect all http traffic to https
-server {
-  listen 80;
-  server_name .forgott.com;
-  return 301 https://$host$request_uri;
-}

diff --git a/site.conf b/site.conf
@@ -0,0 +1,113 @@
+# read more at https://terrty.net/2014/ssl-tls-in-nginx/
+# security test score: https://www.ssllabs.com/ssltest/analyze.html?d=terrty.net
+
+server {
+        # public key, contains your public key and class 1 certificate, to create:
+        # (exapmle for startssl)
+        # $ cat example.com.pem sub.class1.server.ca.pem > /etc/nginx/ssl/domain.pem
+        ssl_certificate /etc/nginx/ssl/domain.pem;
+
+        # private key (decoded), decode encoded with RSA key with command:
+        # $ openssl rsa -in decoded.key -out domain.key
+        ssl_certificate_key /etc/nginx/ssl/domain.key;
+
+        # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+        # to generate your dhparam.pem file, run in the terminal:
+        # $ openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
+        ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+        # don't forget to set secure rights to these files:
+        # $ chmod 400 /etc/nginx/ssl/*
+
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 5m;
+        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+
+        # ciphers based on https://wiki.mozilla.org/Security/Server_Side_TLS
+        # and on https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
+        ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DES";
+        ssl_prefer_server_ciphers on;
+
+        resolver 8.8.8.8;
+        ssl_stapling on;
+        ssl_trusted_certificate /etc/nginx/ssl/ca.pem;
+
+        listen 443 deferred spdy ssl;
+        listen [::]:443 deferred spdy ssl ipv6only=on;
+        server_name terrty.net;
+        root /var/local/octopress/public;
+        index index.html;
+        autoindex off;
+        charset utf-8;
+
+        #don't send the nginx version number in error pages and Server header
+        server_tokens off;
+
+        # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+
+        # enabling HSTS(HTTP Strict Transport Security)
+        # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+        add_header Strict-Transport-Security max-age=31536000 always;
+
+        # config to don't allow the browser to render the page inside an frame or
+        # iframe and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
+        # if you need to allow [i]frames, you can use SAMEORIGIN
+        # or set an uri with ALLOW-FROM uri
+        add_header X-Frame-Options DENY;
+
+        # when serving user-supplied content, include a
+        # X-Content-Type-Options: nosniff header along with the Content-Type:
+        # header to disable content-type sniffing on some browsers.
+        # https://github.com/blog/1482-heads-up-nosniff-header-support-coming-to-chrome-and-firefox
+        add_header X-Content-Type-Options nosniff;
+
+        # this header enables the Cross-site scripting (XSS) filter, it's usually
+        # enabled by default anyway, so the role of this header is to re-enable
+        # the filter for this particular website if it was disabled by the user.
+        add_header X-XSS-Protection "1; mode=block";
+
+        location / {
+                try_files $uri $uri/ =404;
+        }
+
+        # deny access to files, starting with dot (hidden) or ending with ~ (temp)
+
+        location ~ /\. {
+                access_log off;
+                log_not_found off;
+                deny all;
+        }
+
+        location ~ ~$ {
+                access_log off;
+                log_not_found off;
+                deny all;
+        }
+
+        # block of rules for static content
+
+        location ~ /{favicon.ico|favicon.png|robots.txt}$ {
+                access_log off;
+                log_not_found off;
+                expires 1y;
+                add_header Cache-Control public,max-age=259200;
+        }
+
+        location ~*  \.(jpg|jpeg|png|gif|ico|css|js|mp3)$ {
+                expires 30d;
+                add_header Cache-Control public,max-age=259200;
+        }
+
+}
+
+server {
+        # catch all unsecure requests (both IPv4 and IPv6)
+        listen 80 default_server;
+        listen [::]:80 default_server ipv6only=on;
+
+        # this means example.com, *.example.com
+        server_name .example.com;
+
+        # permanently redirect client to https version of the site
+        return 301 https://example.com;
+}
diff --git a/nginx.conf b/nginx.conf
@@ -73,5 +73,5 @@ server {
 server {
   listen 80;
   server_name .forgott.com;
-  return 301 $scheme://$host$request_uri;
+  return 301 https://$host$request_uri;
 }
diff --git a/nginx.conf b/nginx.conf
@@ -73,5 +73,5 @@ server {
 server {
   listen 80;
   server_name .forgott.com;
-  rewrite ^ https://$host$request_uri permanent;
+  return 301 $scheme://$host$request_uri;
 }
diff --git a/nginx.conf b/nginx.conf
@@ -1,3 +1,5 @@
+#read more here http://tautt.com/best-nginx-configuration-for-security/
+
 #don't send the nginx version number in error pages and Server header
 server_tokens off;
 

diff --git a/nginx.conf b/nginx.conf
@@ -44,7 +44,6 @@ server {
 
   # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
   ssl_dhparam /etc/nginx/ssl/dhparam.pem;
-  ssl_session_timeout 5m;
 
   # enables server-side protection from BEAST attacks
   # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html

diff --git a/nginx.conf b/nginx.conf
@@ -1,10 +1,6 @@
 #don't send the nginx version number in error pages and Server header
 server_tokens off;
 
-# config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
-# to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
-add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
-
 # config to don't allow the browser to render the page inside an frame or iframe
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
@@ -65,6 +61,10 @@ server {
   ssl_stapling on;
   ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
 
+  # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+  # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
+  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
   #... the rest of your configuration
 }
 

diff --git a/gistfile1.sh b/gistfile1.sh
@@ -0,0 +1,2 @@
+# to generate your dhparam.pem file, run in the terminal
+openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
diff --git a/nginx.conf b/nginx.conf
@@ -43,8 +43,12 @@ server {
 
   # enable session resumption to improve https performance
   # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
-  ssl_session_cache shared:SSL:10m;
-  ssl_session_timeout 10m;
+  ssl_session_cache shared:SSL:50m;
+  ssl_session_timeout 5m;
+
+  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+  ssl_session_timeout 5m;
 
   # enables server-side protection from BEAST attacks
   # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
@@ -53,7 +57,7 @@ server {
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   # ciphers chosen for forward secrecy and compatibility
   # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
-  ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';
+  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
 
   # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
   # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/

diff --git a/nginx.conf b/nginx.conf
@@ -9,7 +9,7 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
-add_header X-Frame-Options DENY;
+add_header X-Frame-Options SAMEORIGIN;
 
 # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
 # to disable content-type sniffing on some browsers.

diff --git a/nginx.conf b/nginx.conf
@@ -11,6 +11,20 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
 add_header X-Frame-Options DENY;
 
+# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
+# to disable content-type sniffing on some browsers.
+# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
+# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
+# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
+add_header X-Content-Type-Options nosniff;
+
+# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
+# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for 
+# this particular website if it was disabled by the user.
+# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+add_header X-XSS-Protection "1; mode=block";
+
 # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/

diff --git a/nginx.conf b/nginx.conf
@@ -16,7 +16,8 @@ add_header X-Frame-Options DENY;
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
-# directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
+# directives for css and js(if you have inline css or js, you will need to keep it too).
+# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -16,8 +16,7 @@ add_header X-Frame-Options DENY;
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
-# directives for css and js
-# http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
+# directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -15,7 +15,8 @@ add_header X-Frame-Options DENY;
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
-# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
+# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
+# directives for css and js
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 

diff --git a/nginx.conf b/nginx.conf
@@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
-# I've disabled it since it have some restrictions, like not executing inline JS anymore
+# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
-# add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";
+add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 server {
   listen 443 ssl default deferred;
Original file line number	Diff line number	Diff line change
		@@ -1,2 +0,0 @@
		# to generate your dhparam.pem file, run in the terminal
		openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# to generate your dhparam.pem file, run in the terminal
		openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048