Nginx SSL configuration generator

The Nginx preset of the TLS config generator writes a hardened HTTPS server block for Nginx. Choose the profile and options, then copy the server blocks into your site configuration, test with nginx -t and reload.

Example: intermediate profile

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name example.com;

    ssl_certificate     /etc/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com/privkey.pem;

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    root /var/www/example.com;
}

Version requirements

• TLS 1.3: nginx 1.13.0+ built with OpenSSL 1.1.1+. Check with nginx -V.
• http2 on;: nginx 1.25.1+. On older versions remove the line and write listen 443 ssl http2;.
• Post-quantum: ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1; needs OpenSSL 3.5+. With an older OpenSSL nginx refuses to start, so tick the option only after checking.

Test and reload

sudo nginx -t && sudo systemctl reload nginx
curl -sI https://example.com | grep -i strict-transport

Then run the SSL checker to confirm the protocols and chain.

Common mistakes

• Only the leaf in ssl_certificate: browsers may cope, but curl, Java and mobile apps fail. Use fullchain.pem (see the chain builder).
• add_header in a location block: it replaces all add_header lines inherited from the server block, so HSTS silently disappears there. Repeat the HSTS line inside that location.
• Key and certificate do not match: nginx stops with "key values mismatch"; check with the key matcher.