Here is my configuration: <a href="https:&#x2F;&#x2F;github.com&#x2F;majewsky&#x2F;system-configuration&#x2F;blob&#x2F;master&#x2F;hologram-nginx-and-letsencrypt.pkg.toml" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;majewsky&#x2F;system-configuration&#x2F;blob&#x2F;master...</a><p>Domains with this configuration get A+ on ssllabs and securityheaders.io (test with &quot;repo.holocm.org&quot; if you like). It includes an autorenewal script wrapped in a systemd timer unit.<p>There is one bug, though: The autorenewal script fails because letsencrypt crashes when stdin is not a TTY. ( <a href="https:&#x2F;&#x2F;github.com&#x2F;letsencrypt&#x2F;letsencrypt&#x2F;issues&#x2F;2523" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;letsencrypt&#x2F;letsencrypt&#x2F;issues&#x2F;2523</a> )