Node.js TLS configuration generator

The Node.js preset of the TLS config generator produces a small server.js with the TLS options for https.createServer, the HSTS header and a plain HTTP server that redirects to HTTPS. Copy the options into your application.

Example: intermediate profile

const fs = require('node:fs');
const http = require('node:http');
const https = require('node:https');

const options = {
  key: fs.readFileSync('/etc/ssl/example.com/privkey.pem'),
  cert: fs.readFileSync('/etc/ssl/example.com/fullchain.pem'),
  minVersion: 'TLSv1.2',
  ciphers: 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305',
  honorCipherOrder: false,
  ecdhCurve: 'X25519:prime256v1:secp384r1',
};

https.createServer(options, (req, res) => {
  res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains');
  res.end('ok\n');
}).listen(443);

http.createServer((req, res) => {
  res.writeHead(301, { Location: 'https://example.com' + req.url });
  res.end();
}).listen(80);

With Express, pass the app as the request handler: https.createServer(options, app).

Version notes

• Node.js 18 or newer (all current LTS lines) supports TLS 1.3 and these options.
• For post-quantum key exchange set ecdhCurve: 'X25519MLKEM768:X25519:prime256v1:secp384r1', but only if node -p process.versions.openssl prints 3.5 or higher; otherwise server creation throws an error.
• Binding ports 80 and 443 needs root or CAP_NET_BIND_SERVICE; many setups listen on a high port behind a proxy.

Common mistakes

• Only the leaf in cert: clients such as curl and other Node.js programs fail with unable to verify the first certificate. Use the full chain.
• Redirecting to req.headers.host: an attacker can set any Host header. Redirect to your own domain as above.