1
0
Эх сурвалжийг харах

Secure SSL settings (#5109)

* 20m cache, 4h timeout
7d is bonkers, and https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-tcp/ 
suggest 20m cache + 4h timeout 
(with higher timeout you need a bigger cache..)
Pavel Z 3 сар өмнө
parent
commit
e6ecffaee2

+ 2 - 2
install/deb/nginx/nginx.conf

@@ -90,7 +90,7 @@ http {
 	ssl_protocols                   TLSv1.2 TLSv1.3;
 	ssl_session_cache               shared:SSL:20m;
 	ssl_session_tickets             on;
-	ssl_session_timeout             7d;
+	ssl_session_timeout             4h;
 	resolver                        1.0.0.1 8.8.4.4 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
 	resolver_timeout                5s;
 	# Error pages
@@ -127,4 +127,4 @@ http {
 	# Wildcard include
 	include                         /etc/nginx/conf.d/*.conf;
 	include                         /etc/nginx/conf.d/domains/*.conf;
-}
+}

+ 2 - 2
src/deb/nginx/nginx.conf

@@ -81,9 +81,9 @@ http {
 	ssl_ecdh_curve                auto;
 	ssl_prefer_server_ciphers     on;
 	ssl_protocols                 TLSv1.2 TLSv1.3;
-	ssl_session_cache             shared:SSL:10m;
+	ssl_session_cache             shared:SSL:20m;
 	ssl_session_tickets           on;
-	ssl_session_timeout           7d;
+	ssl_session_timeout           4h;
 	#Commented out ssl_stapling directives due to Lets Encrypt ending OCSP support in 2025
 	#ssl_stapling                  on;
 	#ssl_stapling_verify           on;