TLS 1.3 and SSL Configuration Best Practices

/TLS 1.3 vs TLS 1.2

TLS 1.3 (RFC 8446) is the current standard for encrypted transport. It removes legacy insecure algorithms, mandates forward secrecy, and reduces the handshake to a single round-trip (1-RTT), with an optional 0-RTT mode for resumed sessions. For new infrastructure, TLS 1.3 should be the default.

/Recommended Configuration

A modern server should enable TLS 1.3 and TLS 1.2 only, with a curated cipher list. Disable compression (which enables CRIME-style attacks) and enable OCSP stapling to protect privacy and speed up handshakes.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_ecdh_curve X25519:secp384r1;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 valid=300s;

/Forward Secrecy

Forward secrecy ensures that even if a server's long-term private key is compromised in the future, past captured traffic cannot be decrypted. This requires ephemeral key exchange (ECDHE). TLS 1.3 enforces forward secrecy by design; in TLS 1.2 you must explicitly select ECDHE cipher suites.

/Certificate Management

• Use ECDSA or RSA-2048+ certificates from a trusted CA
• Automate renewal (ACME/Let's Encrypt) to prevent expiry outages
• Set a DNS CAA record restricting which CAs may issue for your domain
• Monitor certificate transparency logs for unauthorized issuance

/HSTS and the SSL/TLS Audit

HTTP Strict Transport Security (HSTS) instructs browsers to always use HTTPS, preventing downgrade and hijacking attacks. For production, submit your domain to the HSTS preload list after careful testing.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

“Auditors most often find: TLS 1.0/1.1 still enabled, weak ciphers (CBC, RC4, 3DES), self-signed or expired certs, missing HSTS, and mixed content.”

Our scanner checks your TLS configuration against Mozilla SSL Config Generator recommendations, grades your setup (A+ to F), and flags every deviation. Run a free scan to verify your certificate and cipher posture.