Are settings ssl_session_cache and ssl_session_timeout general enough to be set like this?  These were used in the nginx SSL configuration guide (http://nginx.org/en/docs/http/configuring_https_servers.html#optimization) and have worked for us in the past.  What about the ssl_protocolos and ssl_ciphers attributes?  Their defaults should be safe, but is it common practice to set them to something else?