Nginx Modern TLS 1.3 Ciphers & Mozilla SSL Hardening Profile

Achieve an SSL Labs A+ rating by configuring modern TLS 1.2/1.3 ciphers, OCSP stapling, and disabling insecure SSLv3/TLS 1.0/1.1 protocols.

1. Attack Signature & Impact Analysis

High (Cryptographic Weakness)

Legacy ciphers (CBC mode, RC4, 3DES) are vulnerable to BEAST, POODLE, and SWEET32 attacks that allow eavesdropping on encrypted HTTPS communications.

2. Production Hardening Configuration (`/etc/nginx/conf.d/ssl-modern.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Mozilla Modern SSL Configuration for Nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;

# Enable Session Resumption (Caches TLS handshakes)
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

# Enable OCSP Stapling (Speeds up browser verification)
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Verify supported TLS protocols on live server
openssl s_client -connect yourdomain.com:443 -tls1_3
# Audit live score via Qualys SSL Labs: https://www.ssllabs.com/ssltest/

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Disabling TLS 1.0/1.1 drops support for very old Android 4.x and IE11 browsers. For 99.8% of modern users, this is standard and recommended practice.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: