ssl.conf

listen                443 ssl http2;
listen                [::]:443 ssl http2;

ssl_certificate       /certs/certificate-chain.pem; # <== PERHAPS CHANGE THIS PATH
ssl_certificate_key   /certs/certificate.key; # <== PERHAPS CHANGE THIS PATH

# can be downloaded using `curl https://ssl-config.mozilla.org/ffdhe2048.txt > certs/dhparam`
# or generated using `openssl dhparam -out certs/dhparam 4096`
# GENERATE OR DOWNLOAD
ssl_dhparam /certs/dhparam;

# intermediate configuration as per the recommendations from https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1d&hsts=false&ocsp=false&guideline=5.6
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;