# /etc/nginx/snippets/ssl-params.conf
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
# Yandex DNS — reachable from Russian datacentres, unlike 8.8.8.8 at times.
resolver 77.88.8.8 77.88.8.1 valid=300s;
resolver_timeout 5s;