nginx.ssl.conf

# run nginx in foreground
daemon off;

error_log /var/log/nginx-error.log warn;
pid /var/run/nginx.pid;
worker_processes	auto;

events {
	worker_connections	1024;
}

http {
	sendfile		on;
	include			/etc/nginx/mime.types;
	default_type	application/octet-stream;
	tcp_nopush		on;
	client_body_temp_path /tmp/nginx/body 1 2;
	fastcgi_temp_path /tmp/nginx/fastcgi_temp 1 2;
	keepalive_timeout 70;
	
	client_max_body_size 2G;

	server {
		listen		80;
		return		301 https://$host$request_uri;
	}
	
	server {
		listen		443;
		root		/data/www;
		index		index.php index.html index.htm;	
		
		ssl						on;
		ssl_protocols			TLSv1 TLSv1.1 TLSv1.2;
		ssl_ciphers				AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
		ssl_certificate			/data/crt/site.crt;
		ssl_certificate_key 	/data/crt/site.key;
		ssl_session_cache 		shared:SSL:10m;
		ssl_session_timeout 	10m;
 
		location = /robots.txt {
			allow all;
			log_not_found off;
			access_log off;
		}		

		location ^~ /.well-known {
			allow all;
			auth_basic off;
		}

		if (!-e $request_filename) {
		 	rewrite ^(.*)$ /index.php$1 last;
		}

		location ~ .*\.php(\/.*)*$ {
			include /etc/nginx/fastcgi.conf;
			fastcgi_pass 127.0.0.1:9000;
			fastcgi_index index.php;

			set $path_info "";
			set $real_script_name $fastcgi_script_name;
			
			if ($fastcgi_script_name ~ "^(.+?\.php)(/.+)$") {
				set $real_script_name $1;
				set $path_info $2;
			}

			fastcgi_param SCRIPT_FILENAME $document_root$real_script_name;
			fastcgi_param SCRIPT_NAME $real_script_name;
			fastcgi_param PATH_INFO $path_info;
			fastcgi_param HTTPS on;
			fastcgi_param HTTP_SCHEME https;
		}
	}	
}