diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index 761216d5f..16a26872c 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -6,6 +6,10 @@
 
 server {
     listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    # Let's Encrypt webroot
+    include letsencrypt-webroot;
 
     # CryptPad serves static assets over these two domains.
     # `main_domain` is what users will enter in their address bar.
@@ -46,26 +50,35 @@ server {
     # IMPORTANT: this config is intended to serve assets for at least two domains
     # (your main domain and your sandbox domain). As such, you'll need to generate a single SSL certificate
     # that includes both domains in order for things to work as expected.
-    ssl_certificate         /home/cryptpad/.acme.sh/your-main-domain.com/fullchain.cer;
-    ssl_certificate_key     /home/cryptpad/.acme.sh/your-main-domain.com/your-main-domain.com.key;
-    ssl_trusted_certificate /home/cryptpad/.acme.sh/your-main-domain.com/ca.cer;
+    ssl_certificate /etc/ssl/lets-encrypt/your-main-domain.com/cert;
+    ssl_certificate_key /etc/ssl/lets-encrypt/your-main-domain.com/key;
 
     # diffie-hellman parameters are used to negotiate keys for your session
     # generate strong parameters using the following command
     ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
 
     # Speeds things up a little bit when resuming a session
-    ssl_session_timeout 5m;
-    ssl_session_cache shared:SSL:5m;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;
+    ssl_session_tickets off;
 
-    # You'll need nginx 1.13.0 or better to support TLSv1.3
     ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
 
-    # https://cipherli.st/
-    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
-    ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+
+    # replace with the IP address of your resolver
+    resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220;
 
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
     add_header X-XSS-Protection "1; mode=block";
     add_header X-Content-Type-Options nosniff;
     add_header Access-Control-Allow-Origin "${allowed_origins}";