ssl             on;
ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         'AES256+EECDH:AES256+EDH:!aNULL';
ssl_prefer_server_ciphers   on;
ssl_session_cache       shared:SSL:10m;
ssl_dhparam         /etc/nginx/ssl/dhparam.pem;
ssl_certificate         /etc/nginx/ssl/chain-mail.cppmm.net.ru.crt;
ssl_certificate_key     /etc/nginx/ssl/mail.cppmm.net.ru.key;

ssl_stapling            on;
ssl_stapling_verify     on;
resolver            127.0.0.1 8.8.8.8 valid=300s;
resolver_timeout        10s;

add_header          Strict-Transport-Security max-age=63072000;
add_header          X-Frame-Options DENY;
add_header          X-Content-Type-Options nosniff;