ssl on;
ssl_certificate /путь/к/radiokot.ru.crt;
ssl_certificate_key /путь/к/radiokot.ru.crt.key;
ssl_trusted_certificate /путь/к/globalsign.bundle.crt;
ssl_stapling on;
ssl_stapling_verify on;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve prime256v1;

# not bad ciphers if you want to also support old browsers (< IE 9, < Android 4, etc.)
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_protocols TLSv1 TLSv1.2;

# more secure ciphers (old browsers (< IE 9, < Android 4, etc.) will fail to connect)
# ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256";
# ssl_protocols TLSv1.2;

# generate dhparams.pem using this command: openssl dhparam -out dhparams.pem 2048
ssl_dhparam /etc/nginx/dhparams.pem;

resolver 1.1.1.1 8.8.8.8 valid=600s ipv6=off;
resolver_timeout 5s;

add_header Strict-Transport-Security "max-age=60000000; includeSubdomains; preload";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";