infra/ansible-role-nginx
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

moved ssl_stapling to main config

Browse source
This commit is contained in:
nd 2020-04-16 22:55:35 +02:00
parent b926014bdf
commit be5a9d8b8e
No known key found for this signature in database
GPG key ID: 21B5CD4DEE3670E9
2 changed files with 3 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
files/config/conf.d/ssl.conf
View file

@ -8,9 +8,9 @@ ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECD
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
add_header Strict-Transport-Security "max-age=15768000"; add_header Strict-Transport-Security "max-age=15768000" always;
# OCSP Stapling --- # OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them # fetch OCSP records from URL in ssl_certificate and cache them
#ssl_stapling on; ssl_stapling_verify on;
#ssl_stapling_verify on; ssl_stapling on;

2
templates/vhost.conf.j2
View file

@ -64,7 +64,5 @@ server {
{% if vhost.letsencrypt|d(False) %} {% if vhost.letsencrypt|d(False) %}
ssl_certificate /etc/ssl/nginx_{{ vhost_name }}.chain.crt; ssl_certificate /etc/ssl/nginx_{{ vhost_name }}.chain.crt;
ssl_certificate_key /etc/ssl/private/nginx_{{ vhost_name }}.key; ssl_certificate_key /etc/ssl/private/nginx_{{ vhost_name }}.key;
ssl_stapling_verify on;
ssl_stapling on;
{% endif %} {% endif %}
} }