SSL/TLS Best Practices 2026

A comprehensive guide to deploying and maintaining secure TLS configurations. Covers TLS 1.3 migration, cipher suite hardening, HSTS, automated certificate management, and production-ready server configs.

TLS 1.2 vs TLS 1.3 Comparison

Nginx: Modern TLS Configuration

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name yourapp.com www.yourapp.com;

    # Certificate paths (Let's Encrypt)
    ssl_certificate     /etc/letsencrypt/live/yourapp.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourapp.com/privkey.pem;

    # Modern TLS protocols (disable 1.0, 1.1)
    ssl_protocols TLSv1.2 TLSv1.3;

    # TLS 1.3 ciphers (auto-selected, best practice to list explicitly)
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;  # Let client choose (TLS 1.3)

    # Elliptic curves — prefer X25519, P-256
    ssl_ecdh_curve X25519:prime256v1:secp384r1;

    # Session resumption
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;  # Disable for forward secrecy

    # OCSP stapling (reduces handshake latency)
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/yourapp.com/chain.pem;
    resolver 1.1.1.1 8.8.8.8 valid=300s;

    # DH params (generate: openssl dhparam -out /etc/nginx/dhparam.pem 2048)
    ssl_dhparam /etc/nginx/dhparam.pem;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
}

# HTTP → HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name yourapp.com www.yourapp.com;
    return 301 https://$host$request_uri;
}

Let's Encrypt: Automated Certificate Management

Initial Setup with Certbot

# Install certbot (Ubuntu/Debian)
sudo apt install certbot python3-certbot-nginx

# Obtain certificate + auto-configure nginx
sudo certbot --nginx -d yourapp.com -d www.yourapp.com

# Test renewal process
sudo certbot renew --dry-run

# Certbot auto-renewal is enabled via systemd timer:
sudo systemctl status certbot.timer

acme.sh Alternative (More Flexible)

# Install acme.sh
curl https://get.acme.sh | sh

# Issue certificate (standalone mode)
acme.sh --issue -d yourapp.com -d www.yourapp.com --standalone

# Install to nginx paths
acme.sh --install-cert -d yourapp.com \
  --cert-file      /etc/nginx/ssl/cert.pem \
  --key-file       /etc/nginx/ssl/key.pem \
  --fullchain-file /etc/nginx/ssl/fullchain.pem \
  --reloadcmd      "systemctl reload nginx"

# Renews automatically via cron (added by acme.sh installer)

Certificate Expiry Monitoring

#!/bin/bash
# check-cert-expiry.sh — run via cron, alert if < 30 days
DOMAIN="yourapp.com"
THRESHOLD=30  # days

EXPIRY=$(echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null \
  | openssl x509 -noout -enddate 2>/dev/null \
  | cut -d= -f2)

EXPIRY_EPOCH=$(date -d "${EXPIRY}" +%s)
TODAY_EPOCH=$(date +%s)
DAYS_LEFT=$(( (EXPIRY_EPOCH - TODAY_EPOCH) / 86400 ))

echo "Certificate expires in ${DAYS_LEFT} days"

if [ ${DAYS_LEFT} -lt ${THRESHOLD} ]; then
    # Send alert (webhook, email, PagerDuty, etc.)
    curl -X POST ${SLACK_WEBHOOK} \
      -d "{\"text\":\"⚠️ TLS cert for ${DOMAIN} expires in ${DAYS_LEFT} days\"}"
fi

Apache TLS Configuration

<VirtualHost *:443>
    ServerName yourapp.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile      /etc/letsencrypt/live/yourapp.com/cert.pem
    SSLCertificateKeyFile   /etc/letsencrypt/live/yourapp.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/yourapp.com/chain.pem

    # Modern TLS only
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder off  # TLS 1.3 ignores this

    # OCSP Stapling
    SSLUseStapling on
    SSLStaplingCache "shmcb:/var/run/ocsp(128000)"

    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
</VirtualHost>

TLS Security Checklist