Complete NGINX SSL/TLS Configuration Guide: A+ Rating from SSL Labs

Why Your SSL Configuration Matters

Weak SSL/TLS configurations expose users to downgrade attacks, cipher vulnerabilities, and certificate validation bypasses. SSL Labs (ssllabs.com/ssltest) grades your configuration — an A+ rating demonstrates you have implemented all current best practices.

Optimal NGINX SSL Configuration

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

# HSTS (63072000 seconds = 2 years)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;

FAQ

Should I support TLS 1.0 and 1.1?

No. TLS 1.0 and 1.1 are deprecated and vulnerable. All modern browsers support TLS 1.2 and 1.3. Disabling older versions eliminates known vulnerabilities with no meaningful impact on real visitors.