server {
    ...
    listen 433 ssl http2;
    ...
    ssl on;
    ssl_certificate "....crtca";
    ssl_certificate_key "....key";
    ssl_ciphers HIGH:!RC4:!aNULL:!eNULL:!MD5:!EXPORT:!EXP:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv2;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
}