server {
        listen       443 ssl;       
        server_name  www.XXX.com;      
        proxy_read_timeout 3600s;	 # 設置讀取超時時間

        ssl_certificate      C:/xxxx.pem;
        ssl_certificate_key  C:/xxxx.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        #ssl_ciphers  HIGH:!aNULL:!MD5;
        #ssl_prefer_server_ciphers  on;
		
        client_max_body_size	5m;
        client_body_buffer_size 5m;


        location / {
			#保留代理之前的host 包含客戶端真實的域名和端口號
			proxy_set_header    Host  $host; 
			#保留代理之前的真實客戶端ip
			proxy_set_header    X-Real-IP  $remote_addr;  
			#這個Header和X-Real-IP類似，但它在多級代理時會包含真實客戶端及中間每個代理服務器的IP
			proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
			#表示客戶端真實的協議（http還是https）
			proxy_set_header X-Forwarded-Proto $scheme;
			#指定修改被代理服務器返回的響應頭中的location頭域跟refresh頭域數值
			#如果使用"default"參數，將根據location和proxy_pass參數的設置來決定。
			#proxy_redirect [ default|off|redirect replacement ];
			#proxy_redirect off;

            proxy_pass http://xxxxx;
        }

        # intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers off;
    }

關鍵配置

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

改完記得重啟nginx

配置工具
https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6

測試工具（支持自定義端口的測試好難找）
https://geekflare.com/tools/tls-test

https://myssl.com/