| server {
|
| listen xx.xxx.xx.xx:xx ssl;
|
| server_name example.com;
|
|
|
| ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
|
| ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
|
|
|
| ssl_protocols TLSv1.2 TLSv1.3;
|
| ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
| ## OCSP Stapling
|
| resolver 127.0.0.1;
|
| ssl_stapling on;
|
| ssl_stapling_verify on;
|
| ssl_trusted_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
|
|
|
| return 301 https://www.example.com$request_uri;
|
| }
|