nginx/server/proxy/ssl.yml

parameters:
  _param:
    nginx_proxy_ssl_enabled: false
    nginx_proxy_ssl:
      mode: 'strict'
      enabled: ${_param:nginx_proxy_ssl_enabled}
      engine: salt
      dhparam:
        enabled: True
        numbits: 2048
      ecdh_curve:
        secp521r1:
          name: 'secp521r1'
          enabled: True
      prefer_server_ciphers: "on"
      protocols:
        TLSv1:
          name: 'TLSv1'
          enabled: False
        TLSv1.1:
          name: 'TLSv1.1'
          enabled: False
        TLSv1.2:
          name: 'TLSv1.2'
          enabled: True
      stapling: "on"
      stapling_verify: "on"
      ciphers:
        ECDHE-ECDSA-CHACHA20-POLY1305:
          name: 'ECDHE-ECDSA-CHACHA20-POLY1305'
          enabled: False
        ECDHE-RSA-CHACHA20-POLY1305:
          name: 'ECDHE-RSA-CHACHA20-POLY1305'
          enabled: False
        ECDHE-ECDSA-AES128-GCM-SHA256:
          name: 'ECDHE-ECDSA-AES128-GCM-SHA256'
          enabled: False
        ECDHE-RSA-AES128-GCM-SHA256:
          name: 'ECDHE-RSA-AES128-GCM-SHA256'
          enabled: False
        ECDHE-ECDSA-AES256-GCM-SHA384:
          name: 'ECDHE-ECDSA-AES256-GCM-SHA384'
          enabled: True
        ECDHE-RSA-AES256-GCM-SHA384:
          name: 'ECDHE-RSA-AES256-GCM-SHA384'
          enabled: True
        DHE-RSA-AES128-GCM-SHA256:
          name: 'DHE-RSA-AES128-GCM-SHA256'
          enabled: False
        DHE-RSA-AES256-GCM-SHA384:
          name: 'DHE-RSA-AES256-GCM-SHA384'
          enabled: False
        ECDHE-ECDSA-AES128-SHA256:
          name: 'ECDHE-ECDSA-AES128-SHA256'
          enabled: False
        ECDHE-RSA-AES128-SHA256:
          name: 'ECDHE-RSA-AES128-SHA256'
          enabled: False
        ECDHE-ECDSA-AES128-SHA:
          name: 'ECDHE-ECDSA-AES128-SHA'
          enabled: False
        ECDHE-RSA-AES256-SHA384:
          name: 'ECDHE-RSA-AES256-SHA384'
          enabled: True
        ECDHE-RSA-AES128-SHA:
          name: 'ECDHE-RSA-AES128-SHA'
          enabled: False
        ECDHE-ECDSA-AES256-SHA384:
          name: 'ECDHE-ECDSA-AES256-SHA384'
          enabled: True
        ECDHE-ECDSA-AES256-SHA:
          name: 'ECDHE-ECDSA-AES256-SHA'
          enabled: False
        ECDHE-RSA-AES256-SHA:
          name: 'ECDHE-RSA-AES256-SHA'
          enabled: False
        DHE-RSA-AES128-SHA256:
          name: 'DHE-RSA-AES128-SHA256'
          enabled: False
        DHE-RSA-AES128-SHA:
          name: 'DHE-RSA-AES128-SHA'
          enabled: False
        DHE-RSA-AES256-SHA256:
          name: 'DHE-RSA-AES256-SHA256'
          enabled: False
        DHE-RSA-AES256-SHA:
          name: 'DHE-RSA-AES256-SHA'
          enabled: False
        ECDHE-ECDSA-DES-CBC3-SHA:
          name: 'ECDHE-ECDSA-DES-CBC3-SHA'
          enabled: False
        ECDHE-RSA-DES-CBC3-SHA:
          name: 'ECDHE-RSA-DES-CBC3-SHA'
          enabled: False
        EDH-RSA-DES-CBC3-SHA:
          name: 'EDH-RSA-DES-CBC3-SHA'
          enabled: False
        AES128-GCM-SHA256:
          name: 'AES128-GCM-SHA256'
          enabled: False
        AES256-GCM-SHA384:
          name: 'AES256-GCM-SHA384'
          enabled: False
        AES128-SHA256:
          name: 'AES128-SHA256'
          enabled: False
        AES256-SHA256:
          name: 'AES256-SHA256'
          enabled: False
        AES256-SHA:
          name: 'AES256-SHA'
          enabled: False
        AES128-SHA:
          name: 'AES128-SHA'
          enabled: False
        DES-CBC3-SHA:
          name: 'DES-CBC3-SHA'
          enabled: False
        removeDSS:
          name: '!DSS'
          enabled: True