A sane nginx TLS config in 2026

2026-04-19

TLS 1.2 and 1.3 only, let OpenSSL pick ciphers, enable HTTP/2, add HSTS once you are sure. Certificates from Let's Encrypt with the certbot timer.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=31536000" always;