diff --git a/nginx/server/proxy/ssl.yml b/nginx/server/proxy/ssl.yml
new file mode 100644
index 0000000..66a1938
--- /dev/null
+++ b/nginx/server/proxy/ssl.yml
@@ -0,0 +1,121 @@
+parameters:
+  _param:
+    nginx_proxy_ssl_enabled: false
+    nginx_proxy_ssl:
+      mode: 'strict'
+      enabled: ${_param:nginx_proxy_ssl_enabled}
+      engine: salt
+      dhparam:
+        enabled: True
+        numbits: 2048
+      ecdh_curve:
+        secp521r1:
+          name: 'secp521r1'
+          enabled: True
+      prefer_server_ciphers: "on"
+      protocols:
+        TLSv1:
+          name: 'TLSv1'
+          enabled: True
+        TLSv1.1:
+          name: 'TLSv1.1'
+          enabled: True
+        TLSv1.2:
+          name: 'TLSv1.2'
+          enabled: True
+      stapling: "on"
+      stapling_verify: "on"
+      ciphers:
+        ECDHE-ECDSA-CHACHA20-POLY1305:
+          name: 'ECDHE-ECDSA-CHACHA20-POLY1305'
+          enabled: True
+        ECDHE-RSA-CHACHA20-POLY1305:
+          name: 'ECDHE-RSA-CHACHA20-POLY1305'
+          enabled: True
+        ECDHE-ECDSA-AES128-GCM-SHA256:
+          name: 'ECDHE-ECDSA-AES128-GCM-SHA256'
+          enabled: True
+        ECDHE-RSA-AES128-GCM-SHA256:
+          name: 'ECDHE-RSA-AES128-GCM-SHA256'
+          enabled: True
+        ECDHE-ECDSA-AES256-GCM-SHA384:
+          name: 'ECDHE-ECDSA-AES256-GCM-SHA384'
+          enabled: True
+        ECDHE-RSA-AES256-GCM-SHA384:
+          name: 'ECDHE-RSA-AES256-GCM-SHA384'
+          enabled: True
+        DHE-RSA-AES128-GCM-SHA256:
+          name: 'DHE-RSA-AES128-GCM-SHA256'
+          enabled: True
+        DHE-RSA-AES256-GCM-SHA384:
+          name: 'DHE-RSA-AES256-GCM-SHA384'
+          enabled: True
+        ECDHE-ECDSA-AES128-SHA256:
+          name: 'ECDHE-ECDSA-AES128-SHA256'
+          enabled: True
+        ECDHE-RSA-AES128-SHA256:
+          name: 'ECDHE-RSA-AES128-SHA256'
+          enabled: True
+        ECDHE-ECDSA-AES128-SHA:
+          name: 'ECDHE-ECDSA-AES128-SHA'
+          enabled: True
+        ECDHE-RSA-AES256-SHA384:
+          name: 'ECDHE-RSA-AES256-SHA384'
+          enabled: True
+        ECDHE-RSA-AES128-SHA:
+          name: 'ECDHE-RSA-AES128-SHA'
+          enabled: True
+        ECDHE-ECDSA-AES256-SHA384:
+          name: 'ECDHE-ECDSA-AES256-SHA384'
+          enabled: True
+        ECDHE-ECDSA-AES256-SHA:
+          name: 'ECDHE-ECDSA-AES256-SHA'
+          enabled: True
+        ECDHE-RSA-AES256-SHA:
+          name: 'ECDHE-RSA-AES256-SHA'
+          enabled: True
+        DHE-RSA-AES128-SHA256:
+          name: 'DHE-RSA-AES128-SHA256'
+          enabled: True
+        DHE-RSA-AES128-SHA:
+          name: 'DHE-RSA-AES128-SHA'
+          enabled: True
+        DHE-RSA-AES256-SHA256:
+          name: 'DHE-RSA-AES256-SHA256'
+          enabled: True
+        DHE-RSA-AES256-SHA:
+          name: 'DHE-RSA-AES256-SHA'
+          enabled: True
+        ECDHE-ECDSA-DES-CBC3-SHA:
+          name: 'ECDHE-ECDSA-DES-CBC3-SHA'
+          enabled: True
+        ECDHE-RSA-DES-CBC3-SHA:
+          name: 'ECDHE-RSA-DES-CBC3-SHA'
+          enabled: True
+        EDH-RSA-DES-CBC3-SHA:
+          name: 'EDH-RSA-DES-CBC3-SHA'
+          enabled: True
+        AES128-GCM-SHA256:
+          name: 'AES128-GCM-SHA256'
+          enabled: True
+        AES256-GCM-SHA384:
+          name: 'AES256-GCM-SHA384'
+          enabled: True
+        AES128-SHA256:
+          name: 'AES128-SHA256'
+          enabled: True
+        AES256-SHA256:
+          name: 'AES256-SHA256'
+          enabled: True
+        AES256-SHA:
+          name: 'AES256-SHA'
+          enabled: True
+        AES128-SHA:
+          name: 'AES128-SHA'
+          enabled: True
+        DES-CBC3-SHA:
+          name: 'DES-CBC3-SHA'
+          enabled: True
+        removeDSS:
+          name: '!DSS'
+          enabled: True
\ No newline at end of file