ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers 'ECDHE+CHACHA20:ECDHE+AESGCM';
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
ssl_dhparam /etc/ssl/ssl.dh/dhparam.pem;
ssl_stapling on;
ssl_stapling_verify on;