fastcgi_read_timeout 900;

server {
listen 444 ssl;
server_name FreshTomato SSL;
access_log /var/log/nginx/access.log main;
http2 on;

ssl_certificate /etc/cert.pem;
ssl_certificate_key /etc/key.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
ssl_dhparam /opt/etc/nginx/dhparam;

# intermediate configuration
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

location / {
root /opt/share/www;
index index.html index.htm index.php ;
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location /50x.html {
root /opt/share/www;
}
location ~ ^(?<script_name>.+?\.php)(?<path_info>/.*)?$ {
try_files $script_name = 404;
include /etc/nginx/fastcgi.conf;
fastcgi_param PATH_INFO $path_info;
fastcgi_pass unix:/var/run/php-fpm.sock;
}
location ~ ^/(images|javascript|js|css|flash|media|static)/ {
root /opt/share/www;
expires 10d;
}
}
autoindex on;
autoindex_exact_size off;
autoindex_localtime on;
charset utf-8;
}

nie uzupełniam pola CA Key i wydaje mi się, że jego wymóg dla generacji configu jest niepotrzebny.