server {
  listen              443 ssl;
  server_name         dl.PH_FQDN;

  ssl_certificate     /etc/ssl/cert.crt;
  ssl_certificate_key /etc/ssl/cert.key;

  location / {
    proxy_pass                            http://localhost:3389;
    add_header Strict-Transport-Security  "max-age=31536000; includeSubDomains";
  }
}