diff --git a/conf/nginx-ssl.conf b/conf/nginx-ssl.conf
index 8d1598cb..9b9c672a 100644
--- a/conf/nginx-ssl.conf
+++ b/conf/nginx-ssl.conf
@@ -1,22 +1,6 @@
-# from: https://gist.github.com/konklone/6532544
-###################################################################################
-
-# Basically the nginx configuration I use at konklone.com. 
-# I check it using https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com
-#
-# To provide feedback, please tweet at @konklone or email eric@konklone.com.
-# Comments on gists don't notify the author. 
-# 
-# Thanks to WubTheCaptain (https://wubthecaptain.eu) for his help and ciphersuites.
-# Thanks to Ilya Grigorik (https://www.igvita.com) for constant inspiration.
-
-# Path to certificate and private key.
-# The .crt may omit the root CA cert, if it's a standard CA that ships with clients.
-#ssl_certificate /path/to/unified.crt;
-#ssl_certificate_key /path/to/my-private-decrypted.key;
-
-# Tell browsers to require SSL (warning: difficult to change your mind)
-add_header Strict-Transport-Security max-age=31536000;
+# HTTP Strict Transport Security: tells browsers to require https:// without first checking
+# the http:// version for a redirect.
+# add_header Strict-Transport-Security 'max-age=31536000';
 
 # Prefer certain ciphersuites, to enforce Forward Secrecy and avoid known vulnerabilities.
 # 
@@ -27,9 +11,7 @@ add_header Strict-Transport-Security max-age=31536000;
 ssl_prefer_server_ciphers on;
 ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !MD5 !EXP !DSS !PSK !SRP !kECDH !CAMELLIA !RC4 !SEED';
 
-# Cut out (the old, broken) SSLv3 entirely. 
-# This **excludes IE6 users** and (apparently) Yandexbot.
-# Just comment out if you need to support IE6, bless your soul.
+# Cut out the old, broken, insecure SSLv2 and SSLv3 entirely. 
 ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
 
 # Turn on session resumption, using a 10 min cache shared across nginx processes,
@@ -40,7 +22,7 @@ keepalive_timeout   70;
 
 # Buffer size of 1400 bytes fits in one MTU.
 # nginx 1.5.9+ ONLY
-#ssl_buffer_size 1400; 
+ssl_buffer_size 1400; 
 
 # SPDY header compression (0 for none, 9 for slow/heavy compression). Preferred is 6. 
 # 
@@ -53,14 +35,11 @@ spdy_headers_comp 0;
 #
 # Generated by OpenSSL with the following command:
 #   openssl dhparam -outform pem -out dhparam2048.pem 2048
-# 
-# Note: raising the bits to 2048 excludes Java 6 clients. Comment out if a problem.
 ssl_dhparam STORAGE_ROOT/ssl/dh2048.pem;
 
-
 # OCSP stapling - means nginx will poll the CA for signed OCSP responses, 
 # and send them to clients so clients don't make their own OCSP calls.
-# http://en.wikipedia.org/wiki/OCSP_stapling
+# https://en.wikipedia.org/wiki/OCSP_stapling
 # 
 # while the ssl_certificate above may omit the root cert if the CA is trusted,
 # ssl_trusted_certificate below must point to a chain of **all** certs
diff --git a/conf/nginx.conf b/conf/nginx.conf
index 241bcebe..69d5467e 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -12,7 +12,7 @@ server {
 
 # The secure HTTPS server.
 server {
-	listen 443 ssl;
+	listen 443 ssl spdy;
 
 	server_name $HOSTNAME;
 
diff --git a/setup/system.sh b/setup/system.sh
index 5cbda2e2..20e4abd2 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -17,11 +17,13 @@ hide_output apt-get -y upgrade
 #	         when generating random numbers for private keys (e.g. during
 #	         ldns-keygen).
 # * unattended-upgrades: Apt tool to install security updates automatically.
+# * software-properties-common: Provides apt-add-repository.
 # * ntp: keeps the system time correct
 # * fail2ban: scans log files for repeated failed login attempts and blocks the remote IP at the firewall
 
 apt_install python3 python3-dev python3-pip \
 	wget curl \
+	software-properties-common \
 	haveged unattended-upgrades ntp fail2ban
 
 # Allow apt to install system updates automatically every day.
diff --git a/setup/web.sh b/setup/web.sh
index ec1ef0ac..752f8705 100755
--- a/setup/web.sh
+++ b/setup/web.sh
@@ -13,12 +13,27 @@ if [ -f /usr/sbin/apache2 ]; then
 	hide_output apt-get -y --purge autoremove
 fi
 
+# Ubuntu 14.04 comes with nginx 1.4.6, but we want 1.6.x to have SPDY support
+# which is the more modern best practice. We'll get nginx from the nginx PPA.
+# An update from stock nginx to the nginx ppa causes trouble, so we'll purge
+# first.
+if nginx -v 2>&1 | grep 1.4; then
+	apt-get purge -y nginx
+fi
+
+# Then add the PPA. Test first so we don't have to run apt-get update if the
+# PPA was already present.
+if [ ! -f /etc/apt/sources.list.d/nginx-stable-trusty.list ]; then
+	hide_output add-apt-repository -y ppa:nginx/stable
+	hide_output apt-get update
+fi
+
 # Install nginx and a PHP FastCGI daemon.
-#
-# Turn off nginx's default website.
 
 apt_install nginx php5-fpm
 
+# Turn off nginx's default website.
+
 rm -f /etc/nginx/sites-enabled/default
 
 # Copy in a nginx configuration file for common and best-practices