Caddy TLS configuration generator
Generate a Caddyfile with explicit TLS protocols and ciphers, HSTS, and the option to use your own certificate instead of automatic HTTPS.
Runs in your browser Everything you enter is processed locally with JavaScript and is never uploaded to ssl.sh.
The Caddy preset of the TLS config generator adds explicit TLS settings to a Caddyfile. Caddy already gets certificates automatically, redirects HTTP to HTTPS and uses secure defaults. The generator adds explicit protocol and cipher settings and the HSTS header, and shows how to use your own certificate files.
Example: intermediate profile
example.com {
tls {
protocols tls1.2 tls1.3
ciphers TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
}
header Strict-Transport-Security "max-age=63072000; includeSubDomains"
root * /var/www/example.com
file_server
}
For TLS 1.3 only, use protocols tls1.3 and drop the ciphers line: TLS 1.3 suites are not configurable in Go, which Caddy is written in.
Version notes
- Caddy 2 is required for this syntax.
- Caddy 2.10+ negotiates X25519MLKEM768 with clients that offer it (current Chrome, Firefox, Safari); no setting is needed.
- TLS 1.0 and 1.1 are not available in Caddy, so the "old" profile keeps TLS 1.2 and adds CBC suites.
Test and reload
caddy validate --config /etc/caddy/Caddyfile
caddy reload --config /etc/caddy/Caddyfile
Check the result with the SSL checker; it shows the negotiated key exchange group.
FAQ
Do I need a tls block at all?
Usually not. Caddy's defaults are already close to the intermediate profile. Add the block if you need TLS 1.3 only, a specific cipher list for compliance, or your own certificate files.
How do I use a certificate I bought?
Write tls /path/fullchain.pem /path/privkey.pem inside the site block. Caddy then serves that certificate and does not request one via ACME for that site; you must renew it yourself.
Does Caddy staple OCSP?
Yes, automatically, when the certificate contains an OCSP URL. Let's Encrypt certificates no longer have one, so there is nothing to staple for them.