{{#SSLProfile}}
{{#SSLProfile.CertificateProfile}}
include /usr/syno/etc/www/certificate/{{SSLProfile.CertificateProfile}}/cert.conf*;
{{/SSLProfile.CertificateProfile}}
{{#SSLProfile.TLSProfile}}
include /usr/syno/etc/security-profile/tls-profile/config/{{SSLProfile.TLSProfile}}.conf*;
{{/SSLProfile.TLSProfile}}

{{^SSLProfile.TLSProfile}}
ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers                 ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
{{/SSLProfile.TLSProfile}}
{{#SSLProfile.hsts}}add_header  Strict-Transport-Security max-age=15768000;{{/SSLProfile.hsts}}
ssl_prefer_server_ciphers   on;
{{#SSLProfile.lets_encrypt}}
{{> /usr/syno/share/nginx/LetsEncrypt.mustache }}
{{/SSLProfile.lets_encrypt}}
{{/SSLProfile}}