From 98418998adc4618418151fd90b127ac5c20d98d4 Mon Sep 17 00:00:00 2001
From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
Date: Sat, 20 Jul 2024 04:16:23 +0200
Subject: [PATCH] nginx: Update SSL settings to current guidelines

This reduces the session cache size and adds the
`DHE-RSA-CHACHA20-POLY1305` cipher.
---
 roles/nginx/templates/sslsettings.conf | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/roles/nginx/templates/sslsettings.conf b/roles/nginx/templates/sslsettings.conf
index f76021c84..661ccc9a6 100644
--- a/roles/nginx/templates/sslsettings.conf
+++ b/roles/nginx/templates/sslsettings.conf
@@ -1,12 +1,13 @@
-# https://ssl-config.mozilla.org/#server=nginx&server-version=1.16.1&config=intermediate
-ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+# generated 2024-07-20, Mozilla Guideline v5.7, nginx 1.26.1, OpenSSL 3.3.1, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.26.1&config=intermediate&openssl=3.3.1&guideline=5.7
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
 
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers off;
 ssl_dhparam /etc/ssl/dhparams.pem;
 
 ssl_session_timeout 1d;
-ssl_session_cache shared:SSL:50m;
+ssl_session_cache shared:SSL:10m;
 ssl_session_tickets off;
 
 ssl_stapling on;
-- 
GitLab