OpenSRF 2.5.0 includes an example nginx site configuration file that allows for proxying as described in the README. As we have learned in our testing, the default SSL setup leaves us open to the "Logjam" attack because of weak Diffie-Hellman key exchange parameters (see https://weakdh.org/). We need to address this, either as a matter of further documentation or with some better defaults in the configuration.
My initial suggestion is to add the suggested configuration from the NGINX section of https://weakdh.org/sysadmin.html to examples/nginx/osrf-ws-http-proxy then provide instructions as to generating the dhparams.pem file (which for consistency would probably live in /etc/apache2/ssl on Debian/Ubuntu systems). That's what we've done on our 2.12 test server with success.
(I'll mention that this issue was discovered using the SSL checking site at https://www.ssllabs.com/ssltest/analyze.html).
Right, here's what we're currently using on Ubuntu 16.04 - a combination of what SSLabs suggested and Mozilla's config generator suggested. The comments might be useful for, for example, generating the dhparams (useful for external docs as well as inside our example config file):
listen 443 ssl http2; # managed by Certbot
#ssl_certificate /etc/letsencryp
#ssl_certificat
#include /etc/letsencryp
ssl_certificate /etc/apache2/
ssl_certificate_key /etc/apache2/
if ($scheme != "https") {
return 301 https:/
} # managed by Certbot
# generate with openssl dhparam -out dhparams.pem 2048
ssl_dhparam /etc/apache2/
# From https:/
ssl_prefer_
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
# intermediate configuration. tweak to your needs.
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-
# HSTS (ngx_http_
add_header Strict-
# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
ssl_stapling on;
ssl_stapling_verify on;