* 20m cache, 4h timeout 7d is bonkers, and https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-tcp/ suggest 20m cache + 4h timeout (with higher timeout you need a bigger cache..)
@@ -90,7 +90,7 @@ http {
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:20m;
ssl_session_tickets on;
- ssl_session_timeout 7d;
+ ssl_session_timeout 4h;
resolver 1.0.0.1 8.8.4.4 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
resolver_timeout 5s;
# Error pages
@@ -127,4 +127,4 @@ http {
# Wildcard include
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/conf.d/domains/*.conf;
-}
+}
@@ -81,9 +81,9 @@ http {
ssl_ecdh_curve auto;
ssl_prefer_server_ciphers on;
- ssl_session_cache shared:SSL:10m;
+ ssl_session_cache shared:SSL:20m;
#Commented out ssl_stapling directives due to Lets Encrypt ending OCSP support in 2025
#ssl_stapling on;
#ssl_stapling_verify on;