ssl_prefer_server_ciphers   on;
ssl_protocols               TLSv1.3 TLSv1.2;
ssl_ciphers                 'ECDHE+CHACHA20:ECDHE+AESGCM';
ssl_session_cache           shared:SSL:10m;
ssl_session_timeout         5m;
ssl_dhparam                 /etc/ssl/ssl.dh/dhparam.pem;
ssl_stapling                on;
ssl_stapling_verify         on;