update to @konklone's latest nginx SSL configuration recommendations