Generate secure SSL/TLS configuration for Apache, Nginx, and HAProxy with modern cipher suite recommendations.
Server software ships with TLS defaults tuned for compatibility, not security: old protocols stay enabled and cipher lists are full of suites a modern client will never negotiate. This tool turns a few choices - the server platform and a minimum TLS version among them - into a ready-to-paste block of directives: protocol settings plus a cipher list restricted to forward-secret, AEAD-only suites. The thing people most often get wrong is scope. The output is a fragment to merge into an existing server or virtual-host configuration. It does not include certificate paths, listen directives, or any other settings, and it replaces any TLS directives you already set.
A concrete input and expected output from the current implementation.
Input
Server: Nginx. Minimum TLS version: 1.2
Expected output
ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA256;
A TLS 1.2 floor removes SSLv3 and TLS 1.0/1.1, and the list admits only suites that are both forward-secret and AEAD - ECDHE or DHE exchange with AES-GCM or CHACHA20-POLY1305 - ordered with ECDHE first. This is the Mozilla intermediate cipher list, the de facto baseline for modern TLS configuration, which generators of this kind emit.
The same policy is rendered in each platform's own directive language: ssl_protocols and ssl_ciphers inside an Nginx server block, SSLProtocol and SSLCipherSuite under an Apache mod_ssl VirtualHost, or ssl-default-bind-options and ssl-default-bind-ciphersuites in HAProxy's global section. The cipher names themselves stay identical across all three because Nginx, Apache, and HAProxy all accept OpenSSL cipher names.
The cipher list is the subset of OpenSSL's cipher space that combines forward-secret key exchange (ECDHE or DHE) with an AEAD construction (AES-GCM or CHACHA20-POLY1305), with ECDHE ordered ahead of DHE. Choosing a higher minimum TLS version tightens the result further; at TLS 1.3 it collapses to the few suites the protocol itself defines, because TLS 1.3 fixed its suite list instead of letting servers enumerate one.
TLS 1.3 fixed its cipher suites in the protocol itself (RFC 8446): TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, and TLS_CHACHA20_POLY1305_SHA256. There is no long ordered list to tune because negotiation happens in one round and the server picks from what the client offers. Listing all three is the standard recommendation; CHACHA20-POLY1305 matters mostly on devices without AES hardware acceleration.
Usually not, with two cautions. The block replaces, rather than merges: Nginx refuses to start on duplicate ssl_protocols or ssl_ciphers lines, and Apache silently uses only the last occurrence of a repeated directive, so remove any existing TLS lines first. It also never includes your certificate paths, so keep your ssl_certificate and ssl_certificate_key lines. After pasting, reload and verify with an external TLS test rather than assuming.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.