listen 443 ssl http2;
    
    #HTTP_TO_HTTPS_START
    if ($server_port !~ 443){
        rewrite ^(/.*)$ https://$host$1 permanent;
    }

    if ( $host != 'idcops.iloxp.com' ) {
        rewrite ^(.*)$ https://www.iloxp.com$1 permanent;
    }
    #HTTP_TO_HTTPS_END

    ssl_certificate /etc/nginx/cert/idcops.iloxp.com/idcops.iloxp.com_chain.crt; # managed by Certbot
    ssl_certificate_key /etc/nginx/cert/idcops.iloxp.com/idcops.iloxp.com_key.key; # managed by Certbot
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5';
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;

    #一键申请SSL证书验证目录相关设置
    location ~ \.well-known{
        allow all;
    }