How to properly configure Nginx with WoSign certificate to get A+?

Question

Nginx

Hello! How to properly configure Nginx 1.8.0 with WoSign certificate to get A+? Debian 7. Configured according to the instructions from Habr and this blog . When checking, I get a maximum of B. One of the recommendations about the intermediate certificate. I tried to specify only it - the result does not change. Thanks

Answer 1

Like this ?
Well here is an example from my config.
A+, as you can see in the test.

add_header Strict-Transport-Security "max-age=31536000";
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  ssl                  on;
  ssl_protocols        TLSv1.2;
  ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
  ssl_session_cache    shared:SSL:10m;
  ssl_verify_client    off;
  ssl_session_timeout  5m;
  ssl_prefer_server_ciphers on;
  ssl_ecdh_curve secp521r1;
  ssl_dhparam /path/to/dh.key;
  ssl_certificate /path/to/ssl.crt;
  ssl_certificate_key /path/to/ssl.key;
  ssl_trusted_certificate /path/to/ssl.bundle;
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_stapling_responder http://ocsp2.wosign.cn/ca2g2/server1/free;
  resolver 8.8.8.8;
  ssl_session_tickets on;
  ssl_session_ticket_key /path/to/ticket.key;

Answer 2

habrahabr.ru/post/252821

Answer 3

But it was interesting. Are these certificates reliable? How about browser support?

Answer 4

I received two files for Nginx from VuSin:
1_domen.ru_bundle.crt
2_domen.ru.key
Correctly, I understand that they should be referenced here:
ssl_certificate /path/to/ssl.crt;
ssl_certificate_key /path/to/ssl.key;
What should be indicated here? :
ssl_dhparam /path/to/dh.key;
ssl_trusted_certificate /path/to/ssl.bundle;
Sorry for the noob questions - I'm just learning. And got confused.