Nginx SSL/TLS Configuration

Getting TLS right in Nginx requires choosing the correct ssl_protocols, cipher suites, and security headers. Our generator follows Mozilla's recommended profiles so your A+ rating is a copy-paste away.

Protocols and ciphers

Allow TLS 1.2 and 1.3 only, and let the client choose among modern AEAD ciphers.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

HSTS, OCSP stapling and session settings

HSTS tells browsers to use HTTPS only. Only enable includeSubDomains or preload once every subdomain serves HTTPS. Stapling reduces handshake latency.

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

Open the TLS / SSL generator

Frequently asked questions

Is TLS 1.0 or 1.1 still needed?

No. Both are deprecated and disabled by all current browsers.

What does the "always" flag do on add_header?

Without it Nginx only adds the header on 2xx and 3xx responses, so error pages would go out without HSTS.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration
• A Simple IP Plan for Your Home Network