Certificates and TLS
TLS settings
The settings that decide how a browser and your load balancer agree on encryption. Sensible defaults are already in place, so most people never open this. It is here for the people who have to.
Only what your nginx can do is offered
The manager reads nginx -V from the real binary on each node and works out which
modules are compiled in. A setting for a module you do not have is simply not there. That is the
reason you cannot save something that would stop nginx starting.
Protocols
| Protocol | Position |
|---|---|
| TLS 1.3 | On. This is what you want for nearly all traffic. |
| TLS 1.2 | On. Still needed by a long tail of older clients and some payment terminals. |
| TLS 1.1 and 1.0 | Off. Both are formally deprecated and turning them on is a compliance failure in most audits. |
| HTTP/2 | On by default. Faster for pages with many small resources. |
| HTTP/3 and QUIC | Available, because the build includes the module. Worth turning on for mobile heavy traffic. |
OCSP stapling
With stapling on, your server fetches the certificate's revocation status itself and hands it to the visitor along with the certificate. Without it, the visitor's browser may go and ask the certificate authority, which is slower and tells that authority which sites the visitor is looking at. Leave it on.
Session cache
A shared session cache lets a returning visitor skip the expensive part of the handshake. It is on by default with a sensible size. The one thing to know in a cluster: the cache is per node, so a visitor whose next request lands on the other node pays for a full handshake. That is normal and it costs milliseconds.
Strict transport security
Think before you set a long max age
HSTS tells browsers to refuse plain http for this name for a period you choose. That is exactly what you want, and it is also very hard to take back: a browser that has been told two years will not talk to that name over http for two years, whatever you do afterwards. Start with a short value, confirm everything on the name works over https, then raise it.
Cipher suites
The default list is a modern one and most people should leave it alone. Two situations justify changing it:
- An audit or a policy names specific suites you must offer or must not offer.
- A client you cannot change needs something the default list leaves out. In that case, add the one thing rather than replacing the whole list.
For TLS 1.3 the suite list is short and fixed by the standard, so most cipher tuning really only affects TLS 1.2 traffic.
Common questions
Are these settings per site or per fleet?
Per site, so one legacy application can keep TLS 1.2 without dragging your other sites back with it.
Will turning on HTTP/3 break anything?
It is negotiated, so a client that does not support it uses HTTP/2 or HTTP/1.1. The thing to check is that UDP 443 is open, since QUIC does not use TCP.
How do I test what my site actually offers?
Any external TLS testing service will tell you, and openssl s_client with the -groups option will tell you about the key exchange specifically.
Step by step instructions
The how to section has searchable, task shaped answers. Search it for tls.
Related features
Post quantum key exchange
X25519MLKEM768 first, classic curves behind it.
Read moreLet's Encrypt certificates
Free certificates that renew themselves, in a cluster.
Read moreSites
One hostname and every rule that goes with it.
Read moreThe nginx build
nginx from source with 80 modules, rebuilt from the GUI.
Read more