dotvitals

SSL Config Generator

Generate a modern TLS protocol and cipher suite configuration for your web server, based on your compatibility needs.

One machine often serves several names, each with its own certificate and settings, so the configuration is for the name that actually answers. We also compare against what this name was observed negotiating, and a different one would be judged on the wrong evidence.

About the ssl config generator

Choosing which TLS protocol versions and cipher suites a server should offer is a trade-off between security and compatibility with older clients, and hand-writing the resulting configuration for a specific server's syntax is easy to get subtly wrong. This generator asks what compatibility level you need and produces the matching configuration. A modern profile restricts the server to TLS 1.2 and 1.3 only, with forward-secret cipher suites, which is the right default for most sites today since it removes deprecated protocol versions entirely rather than merely deprioritizing them, closing off downgrade attacks rather than just discouraging them.

An intermediate profile keeps TLS 1.2 as a floor but widens the cipher suite list slightly for older clients that a modern-only configuration would otherwise reject, which is a reasonable choice for a site that still measurably serves a meaningful number of older browsers or legacy internal clients. The generated snippet is written for the specific server you choose, nginx, Apache or HAProxy, using each one's actual directive syntax for protocol versions and cipher lists, so it can be pasted directly into the relevant configuration file rather than translated by hand from generic guidance.

Applying the generated configuration and then re-checking the site with an SSL checker confirms the server is actually offering the intended protocols and ciphers, since a syntax mistake in the configuration file can cause a server to silently fall back to its old defaults instead of failing to start. That verification step is worth the extra few minutes, since a server quietly running on its old defaults looks identical to a correctly reconfigured one until something actually tries to negotiate a disallowed protocol or cipher.

Common questions

Which servers are supported?
Configuration snippets are generated for nginx, Apache (mod_ssl) and HAProxy, using each server's own directive syntax.
Should I choose modern or intermediate compatibility?
Modern (TLS 1.2 and 1.3 only) is right for most sites today. Choose intermediate only if you have confirmed a meaningful share of visitors still use older clients that modern-only would reject.
Does this replace obtaining a certificate?
No, this generates the protocol and cipher configuration around an existing certificate; you still need a certificate from a CA such as Let's Encrypt installed separately.
Will this configuration disable TLS 1.0 and 1.1?
Yes, both the modern and intermediate profiles exclude TLS 1.0 and 1.1, which are deprecated by RFC 8996 and should not be offered by any current server.