add ssl/tls hardening to nginx

docker/nginx/nginx.conf

@@ -13,5 +13,16 @@ http {
     access_log /var/log/nginx/access.log;
     error_log  /var/log/nginx/error.log;
 
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 1.1.1.1 8.8.8.8 valid=300s;
+    resolver_timeout 5s;
+
     include /etc/nginx/conf.d/*.conf;
 }

tests/test_tls.py

@@ -0,0 +1,32 @@
+"""Test that TLS is properly hardened on all HTTPS sites."""
+
+import socket
+import ssl
+
+import pytest
+
+HOST = "www.hantim.net"
+
+
+def test_tls13_works():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_3
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_3
+    with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
+        assert s.version() == "TLSv1.3"
+
+
+def test_tls12_works():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_2
+    with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
+        assert s.version() == "TLSv1.2"
+
+
+def test_tls11_rejected():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_1
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_1
+    with pytest.raises((ssl.SSLError, OSError)):
+        ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)