diff --git a/debian/resources/nginx/fusionpbx b/debian/resources/nginx/fusionpbx
index e632b17..80da452 100755
--- a/debian/resources/nginx/fusionpbx
+++ b/debian/resources/nginx/fusionpbx
@@ -176,14 +176,16 @@ server {
 }
 
 server {
-	listen 443 ssl;
+	listen 443 ssl http2;
 	server_name fusionpbx;
 
 	ssl_certificate         /etc/ssl/certs/nginx.crt;
 	ssl_certificate_key     /etc/ssl/private/nginx.key;
-	ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
-	ssl_ciphers             HIGH:!ADH:!MD5:!aNULL;
-	#ssl_dhparam
+	ssl_protocols		TLSv1.2 TLSv1.3;
+	ssl_ciphers		ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+	ssl_session_cache	shared:SSL:40m;
+	ssl_session_timeout	2h;
+	ssl_session_tickets	off;
 
 	#redirect letsencrypt to dehydrated
 	location ^~ /.well-known/acme-challenge {