Increased Security Options For Nginx

This article gives some examples of improved security settings that may be required by some PCI scans. The involve using a dhparam.pem with an increased key size(ssl_dhparam), restricting the TLS versions used (ssl_protocols) as well as the ciphers used (ssl_ciphers). 
By default MDOQ provides a dhparam.pem with key size 4096.

Steps

1. Create instance
2. Add the following options to Additional SSL Settings within the Nginx component configuration
   • `ssl_protocols`: `TLSv1.1 TLSv1.2`
   • `ssl_ciphers`: `'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !kECDH !DSS !MD5 !RC4 !EXP !PSK !SRP !CAMELLIA !SEED'`
   • `ssl_dhparam`: `/etc/nginx/dhparam.pem`
   This should look like:
   
3. Sync Nginx
4. Test
5. If happy, carry out the same steps on the production instance.