server {
  listen       443;
  server_name yourdomain.com;
  index index.html index.htm index.php;
  root /data/wwwroot/blog;

  #ssl on;   #如果硬性要求全部走https协议，这里开启ssl on
  ssl_certificate   /usr/local/nginx/ssl/yourdomain.com.crt;
  ssl_certificate_key  /usr/local/nginx/ssl/yourdomain.com.key;

  #ssl性能调优
  #nginx 1.13.0支持了TLSv1.3,TLSv1.3相比之前的TLSv1.2、TLSv1.1等性能大幅提升
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
  ssl_prefer_server_ciphers on;
  ssl_session_timeout 10m;
  #使用ssl_session_cache优化https下Nginx的性能
  ssl_session_cache builtin:1000 shared:SSL:10m;
  #OCSP Stapling 开启。OCSP是用于在线查询证书吊销情况的服务，使用OCSP Stapling能将证书有效状态的信息缓存到服务器，提高 TLS 握手速度
  ssl_stapling on;
  #OCSP Stapling 验证开启
  ssl_stapling_verify on;

  location ~ [^/]\.php(/|$) {
    fastcgi_pass  unix:/tmp/php-cgi.sock;
    fastcgi_index index.php;
    include fastcgi.conf;
  }

  location / {
  	if (!-e $request_filename) {
  		rewrite  ^(.*)$  /index.php?s=/$1  last;
  		break;
  	}
  }
	location /nginx_status
	{
	stub_status on;
		access_log   off;
	}

	location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
	{
		expires      30d;
	}

	location ~ .*\.(js|css)?$
	{
		expires      12h;
	}

	location ~ /.well-known {
		allow all;
	}

	location ~ /\.
	{
		deny all;
	}

	error_log  /home/wwwlogs/error.www.codelife.log;

}

配置完后验证 nginx 配置有没有错误：
nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful