TLS Configuration Generator
Generate a modern TLS configuration for Nginx, Apache, HAProxy or Caddy: TLS 1.2 and 1.3 with forward-secret ciphers, session settings and HSTS.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a TLS configuration
Output
TLS settings
530 characters
Follows the shape of Mozilla's server-side TLS guidelines: intermediate allows TLS 1.2 with forward-secret AEAD ciphers only and suits almost every site; modern drops 1.2 and with it some older Android and Java clients. TLS 1.3 suites are not configurable in Nginx and Apache because all of them are good. Enable HSTS only once every subdomain you serve has HTTPS.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Following Mozilla's guidelines
The profiles follow the shape of Mozilla's Server Side TLS guidelines, which most TLS configuration advice is derived from. TLS 1.0 and 1.1 are off: browsers removed them in 2020 and RFC 8996 deprecates them. TLS 1.3 cipher suites are not configurable in Nginx and Apache because every one of them is strong.
HSTS last
Strict-Transport-Security tells browsers never to use HTTP for the domain for max-age seconds. Turn it on once every subdomain serves HTTPS, since includeSubDomains applies to all of them, and only submit to the preload list when you are sure, because removal takes months.