Nginx SSL/TLS configuration for “A+” Qualys SSL Labs ratin

#
# Name: nginx-tls.conf
# Auth: James Lau
# Date: 09 Dec 2015
# Desc: Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating
#
# Enables HTTP/2, PFS, HSTS and OCSP stapling. Configuration options not related
# to SSL/TLS are omitted here.
#
# Example: https://www.ssllabs.com/ssltest/analyze.html?d=yusky.me
#
server {
listen [::]:80;
listen 80;
server_name domain.tld www.domain.tld;
# Redirect all non-https requests
rewrite ^ https://$host$request_uri? permanent;
}
server {
listen [::]:443 default_server ssl http2;
listen 443 default_server ssl http2;
server_name domain.tld www.domain.tld;
# Certificate(s) and private key
ssl_certificate /etc/ssl/domain.crt;
ssl_certificate_key /etc/ssl/domain.key;
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
ssl_dhparam /path/to/dhparam.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_session_timeout 1d;
ssl_session_cache shared:TLS:10m;
ssl_session_tickets off;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 43.225.44.1; # hp.hupo.hk
## verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
# Set HSTS to 365 days
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
}