SSL/TLS Configuration Generator
SSL/TLS Configuration Generator
Generate secure SSL/TLS configs for Nginx, Apache, Caddy, HAProxy, and Traefik. Based on Mozilla’s recommendations.
Web Server
Security Level
Modern
A+ rating, TLS 1.3 only, may break old clients
Intermediate
Good balance of security and compatibility
Old
Maximum compatibility, lower security
TLS Version
Features
HSTS (HTTP Strict Transport Security)
Forces HTTPS connections and prevents downgrade attacks
HSTS Preload
Include domain in browser preload lists (requires HSTS)
OCSP Stapling
Improves performance by bundling certificate status
Session Resumption
Faster reconnections by reusing TLS sessions
HTTP/2
Enable HTTP/2 protocol for better performance
Certificate Pinning
Pin specific certificates (advanced, risky if misconfigured)
Configuration
Compatible Clients
Frequently Asked Questions
What’s the difference between Modern, Intermediate, and Old security levels?
Modern uses only TLS 1.3 with the strongest ciphers for maximum security but may break older clients. Intermediate supports TLS 1.2 and 1.3 with strong ciphers for balanced security and compatibility. Old includes legacy protocols and weaker ciphers for maximum compatibility with very old clients.
Should I enable HSTS and HSTS Preload?
Yes, HSTS prevents downgrade attacks and ensures all connections use HTTPS. HSTS Preload adds your domain to browser preload lists but requires careful consideration – once enabled, it’s difficult to reverse. Only enable preload if you’re confident your site will always support HTTPS.
Is certificate pinning safe to use?
Certificate pinning provides strong protection against certificate authority compromise but is risky if misconfigured. If your pinned certificate expires or changes without updating the configuration, you’ll lock out all users. Only use pinning if you have robust certificate management processes in place.
How do I test my SSL/TLS configuration?
Use tools like SSL Labs Server Test, our SSL Checker tool, or command-line tools like openssl s_client and testssl.sh. These tools will verify your cipher suites, protocol support, and identify potential security issues.
How often should I update my SSL/TLS configuration?
Review your configuration every 6-12 months or when new vulnerabilities are discovered. Stay updated with Mozilla’s SSL Configuration Generator recommendations, disable deprecated protocols and ciphers, and ensure you’re using current TLS versions.
Founded
2023 in London, UK
Contact
hello@releaserun.com