Let's look at some of the differences:
- listen 443 http2 default_server;: We add the default_server so that NGINX has a default configuration it will use during the negotiation phase. This is because the Server Name Indication (SNI) only occurs after the connection has been negotiated. Without specifying the default_server directive, the initial handshake would revert to TLS 1.0 (the NGINX default).
- ssl_protocols TLSv1.1 TLSv1.2;: We specify only the TLS 1.1 and 1.2 protocols, which disables the older 1.0 (vulnerable to POODLE attacks). This also ensures that the older SSLv2 and SSLv3 remain disabled as well.
- ssl_ciphers HIGH:!aNULL:!MD5:!kEDH;: While this doesn't look much different to our previous examples, we have added ...