# Node.js HTTPS TLS Configuration Generator

> Node.js https.createServer TLS options: minVersion, ciphers, ecdhCurve incl. X25519MLKEM768, HSTS and an HTTP redirect.

Source: https://ssl.sh/tools/tls-config-generator/nodejs/
Last updated: 2026-11-10

Generate the options for https.createServer with secure protocols and ciphers, HSTS and an HTTP-to-HTTPS redirect.

The Node.js preset of the [TLS config generator](https://ssl.sh/tools/tls-config-generator/) produces a small `server.js` with the TLS options for `https.createServer`, the HSTS header and a plain HTTP server that redirects to HTTPS. Copy the options into your application.

## Example: intermediate profile

```javascript
const fs = require('node:fs');
const http = require('node:http');
const https = require('node:https');

const options = {
  key: fs.readFileSync('/etc/ssl/example.com/privkey.pem'),
  cert: fs.readFileSync('/etc/ssl/example.com/fullchain.pem'),
  minVersion: 'TLSv1.2',
  ciphers: 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305',
  honorCipherOrder: false,
  ecdhCurve: 'X25519:prime256v1:secp384r1',
};

https.createServer(options, (req, res) => {
  res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains');
  res.end('ok\n');
}).listen(443);

http.createServer((req, res) => {
  res.writeHead(301, { Location: 'https://example.com' + req.url });
  res.end();
}).listen(80);
```

With Express, pass the app as the request handler: `https.createServer(options, app)`.

## Version notes

- Node.js 18 or newer (all current LTS lines) supports TLS 1.3 and these options.
- For post-quantum key exchange set `ecdhCurve: 'X25519MLKEM768:X25519:prime256v1:secp384r1'`, but only if `node -p process.versions.openssl` prints 3.5 or higher; otherwise server creation throws an error.
- Binding ports 80 and 443 needs root or `CAP_NET_BIND_SERVICE`; many setups listen on a high port behind a proxy.

## Common mistakes

- **Only the leaf in `cert`**: clients such as curl and other Node.js programs fail with [unable to verify the first certificate](https://ssl.sh/errors/node-unable-to-verify-leaf-signature/). Use the full chain.
- **Redirecting to `req.headers.host`**: an attacker can set any Host header. Redirect to your own domain as above.


## FAQ

**Should Node.js terminate TLS itself?**

It can, and the options here are production-ready. Many deployments still put Nginx, a load balancer or a CDN in front for certificate automation and HTTP/2; then configure TLS there.

**How do I reload a renewed certificate without restarting?**

Call server.setSecureContext() with the new key and cert after your ACME client renews, for example from a file watcher or a SIGHUP handler.

**Which OpenSSL does my Node.js use?**

Run node -p process.versions.openssl. Official Node.js builds bundle their own OpenSSL; distribution packages may link the system library.