simplify cipher list, better dhparams

docs/example.nginx.conf

@@ -31,16 +31,25 @@ server {
     # nginx doesn't let you set server_name via variables, so you need to hardcode your domains here
     server_name your-main-domain.com your-sandbox-domain.com;
 
+    # You'll need to Set the path to your certificates and keys here
     ssl_certificate         /home/cryptpad/.acme.sh/your-main-domain.com/fullchain.cer;
     ssl_certificate_key     /home/cryptpad/.acme.sh/your-main-domain.com/your-main-domain.com.key;
     ssl_trusted_certificate /home/cryptpad/.acme.sh/your-main-domain.com/ca.cer;
 
-    ssl_dhparam /etc/nginx/dhparam.pem;
+    # diffie-hellman parameters are used to negotiate keys for your session
+    # generate strong parameters using the following command
+    ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
+
+    # Speeds things up a little bit when resuming a session
     ssl_session_timeout 5m;
-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # omit SSLv3 because of POODLE
+    ssl_session_cache shared:SSL:5m;
-    # ECDHE better than DHE (faster)  ECDHE & DHE GCM better than CBC (attacks on AES)  Everything better than SHA1 (deprecated)
+
-    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA';
+    # You'll need nginx 1.13.0 or better to support TLSv1.3
-    ssl_prefer_server_ciphers on;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    # https://cipherli.st/
+    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
+    ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
 
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
     add_header X-XSS-Protection "1; mode=block";