use mozilla guideline ssl config

scripts/docker/nginx/Dockerfile

@@ -3,7 +3,8 @@ FROM nginx:1.26
 RUN rm /etc/nginx/conf.d/default.conf && \
   mkdir /etc/nginx/ssl && \
   mkdir /etc/nginx/configs && \
-  openssl req -x509 -noenc -newkey rsa:4096 -keyout /etc/nginx/ssl/key.pem -out /etc/nginx/ssl/req.pem -days 365 -subj "/C=GB/ST=Devon/L=Plymouth/O=HM Land Registry/OU=DDaT/CN=localhost"
+  openssl req -x509 -noenc -newkey rsa:2048 -keyout /etc/nginx/ssl/key.pem -out /etc/nginx/ssl/req.pem -days 90 -subj "/C=GB/ST=Devon/L=Plymouth/O=HM Land Registry/OU=DDaT/CN=localhost" && \
+  openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
 
 # The base server config, which sets up the SSL etc.
 COPY nginx.conf /etc/nginx/conf.d

scripts/docker/nginx/nginx.conf

@@ -1,30 +1,34 @@
+# generated 2024-06-12, Mozilla Guideline v5.7, nginx 1.26, OpenSSL 3.0.11, intermediate configuration, no OCSP
+# https://ssl-config.mozilla.org/#server=nginx&version=1.26&config=intermediate&openssl=3.0.11&ocsp=false&guideline=5.7
 server {
-  # listen on port 80 (http)
-  listen 80;
-  server_name _;
+  listen 80 default_server;
+  listen [::]:80 default_server;
 
-  if ($ssl_protocol = "") {
-       return 301 https://$host$request_uri;
+  location / {
+      return 301 https://$host$request_uri;
   }
 }
 
 server {
-  listen       443 ssl;
-  server_name  _;
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  http2 on;
 
-  # We generated these during docker image creation (see dockerfile)
-  ssl_certificate           /etc/nginx/ssl/req.pem;
-  ssl_certificate_key       /etc/nginx/ssl/key.pem;
+  ssl_certificate /etc/nginx/ssl/req.pem;
+  ssl_certificate_key /etc/nginx/ssl/key.pem;
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+  ssl_session_tickets off;
+  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
 
+  # intermediate configuration
   ssl_protocols TLSv1.2 TLSv1.3;
-  ssl_prefer_server_ciphers on;
-  ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+  ssl_prefer_server_ciphers off;
 
-  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
-  add_header X-Frame-Options DENY;
-  add_header X-Content-Type-Options nosniff;
+  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
 
   # As part of the provisioning process, files containing apps /location directives will be placed in here
   include /etc/nginx/configs/*.conf;
-
 }