From 6ce29669e949c877412c50387d0acea163c22750 Mon Sep 17 00:00:00 2001
From: Jordan Bradley <phrag@nsa.wtf>
Date: Sun, 12 Jun 2016 13:00:20 +0200
Subject: [PATCH] Harden TLS

+Strongest TLS Ciphers (Ephemeral Elliptic Curve Diffie-Hellman, Galois/Counter Mode)
+Stapling
---
 data/templates/nginx/plain/yunohost_admin.conf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf
index bcd99493b..a942bc2e8 100644
--- a/data/templates/nginx/plain/yunohost_admin.conf
+++ b/data/templates/nginx/plain/yunohost_admin.conf
@@ -21,9 +21,13 @@ server {
     ssl_session_cache shared:SSL:50m;
     ssl_prefer_server_ciphers on;
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-    ssl_ciphers ALL:!aNULL:!eNULL:!LOW:!EXP:!RC4:!3DES:+HIGH:+MEDIUM;
+    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+    ssl_ecdh_curve secp384r1;
+    ssl_stapling on;
+    ssl_stapling_verify on;
 
     add_header Strict-Transport-Security "max-age=31536000;";
+    add_header X-Content-Type-Options nosniff;
 
     location / {
         return 302 https://$http_host/yunohost/admin;