switch to newer image for nginx/ssl, enable oscp stapling, update ssl ciphers