TLS 配置生成器

选择服务器及其版本，选定配置方案，然后复制按 TLSRef Server Side TLS 指南（Mozilla 指南的延续）生成的配置。只要你的服务器版本能在配置中指定后量子 X25519MLKEM768，就会启用它。已经有在用的配置？把它粘贴到“解读我的配置”中。

100% 本地运行——所有操作都在你的浏览器中完成，不会向任何服务器发送数据

服务器

nginx 版本

留空则使用当前版本 1.30.6。

配置方案

现代仅 TLS 1.3，适用于 2018 年及以后的客户端中级TLS 1.2 和 1.3——几乎适用于所有服务器旧版TLS 1.0 及更高版本，仅用于非常旧的客户端

OpenSSL 版本

服务器构建时所用的 OpenSSL（见 openssl version 的输出）。留空则使用长期支持分支 3.5.9。

后量子密钥交换

你的服务器版本无法在配置中指定的组会被省略，原因见下方说明。

HTTP 严格传输安全（HSTS）

让浏览器在两年内只通过 HTTPS 访问。

OCSP Stapling

仅在你的 CA 仍运行 OCSP 响应器时才有用。

后量子密钥交换已启用：此配置指定了 X25519MLKEM768。

/etc/nginx/nginx.conf

# 由 ecdsa.com 根据 TLSRef 指南 6.0 生成，中级方案：nginx 1.30.6，搭配 OpenSSL 3.5.9
# 选项：HSTS

http {

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;
        ssl_certificate /path/to/signed_cert_plus_intermediates;
        ssl_certificate_key /path/to/private_key;

        # HTTP 严格传输安全（63,072,000 秒，需要 ngx_http_headers_module）
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
    }

    # 中级方案配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

    # ssl_session_ticket_key 可替代共享会话缓存
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # 约 40,000 个会话

    # 将明文 HTTP 重定向到 HTTPS
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        return 308 https://$host$request_uri;
    }
}

此配置设置的内容

软件: nginx · 1.30.6 · OpenSSL 3.5.9
配置方案: 中级，TLSRef 指南 6.0
协议: TLSv1.2, TLSv1.3
TLS 1.3 密码套件: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256
TLS 1.2 密码套件: ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-CHACHA20-POLY1305
密钥交换组: X25519MLKEM768, x25519, secp256r1, secp384r1
HSTS: max-age 63,072,000 秒
OCSP Stapling: 关闭
兼容的最旧客户端: Firefox 31.3.0, Android 4.4.2, Chrome 49, Edge 15 on Windows 10, IE 11 on Windows 10, Java 8u161, OpenSSL 1.0.1l, Opera 20, Safari 9

说明

正常已配置后量子密钥交换：X25519MLKEM768。
警告带 includeSubDomains 的 HSTS 会让浏览器在 63,072,000 秒内拒绝所有子域名上的明文 HTTP：部署前确认所有子域名都已提供 HTTPS。
信息证书密钥类型：ECDSA和RSA。
信息ECDSA 证书曲线：P-256和P-384。
信息RSA 证书：至少 2,048 位。
信息证书有效期：指南建议 90 天，最长 366 天。
信息兼容的最旧客户端：Firefox 31.3.0、Android 4.4.2、Chrome 49、Edge 15 on Windows 10、IE 11 on Windows 10、Java 8u161、OpenSSL 1.0.1l、Opera 20和Safari 9。

来源与许可证

配置遵循 TLSRef Server Side TLS 指南 6.0（旧版方案遵循 5.8 版）以及 TLS Configurator 的逻辑。TLS Configurator 是 Mozilla 的 SSL 配置生成器的后继项目，由 April King、Gene Wood、Julien Vehent、Glenn Strauss 及其他贡献者开发。指南数据和移植的 Configurator 代码依据 Mozilla Public License 2.0 使用，并作为独立文件保存；我们对移植代码所做的修改也以同一许可证发布。

Node.js、Java、.NET 以及系统级 OpenSSL 配置由 ecdsa.com 按同一指南编写。

本站附带的开源软件包的许可证

Where the settings come from

Every configuration on this page follows the TLSRef Server Side TLS guidelines, the community continuation of Mozilla's Server Side TLS guidelines. Guideline 6.0 defines two profiles. Modern allows TLS 1.3 only (RFC 9846, the 2026 revision of RFC 8446) and suits services whose clients are all from 2018 or later. Intermediate adds TLS 1.2 with forward-secret ECDHE and AEAD cipher suites only, and is the right default for almost every public server. The old profile, with TLS 1.0 and 1.1, was dropped in 6.0; the generator takes it from guideline 5.8, as the upstream TLS Configurator does, and says so in the output. TLS 1.0 and 1.1 have been deprecated since RFC 8996, so use the old profile only for clients that cannot do better.

The server templates are a port of the TLS Configurator, the successor of Mozilla's SSL Configuration Generator, covering 24 servers. Node.js, Java, .NET and the system-wide OpenSSL configuration are written by ecdsa.com on the same guidelines, which brings the total to 28. The guideline data and the ported code are licensed under the Mozilla Public License 2.0 and kept in separate files, as that license requires; the attribution under the tool links to both.

Why the version matters

A configuration must parse on the software that loads it. nginx learned http2 on in 1.25.1; Apache staples OCSP only from 2.4.13; OpenSSL 3.0 refuses TLS 1.0 unless the security level is lowered to 0. The generator knows these thresholds for every server, starts from the current release of each product, and adapts the output when you enter an older version. A version that cannot do what the profile asks — the modern profile on a server without TLS 1.3, say — produces an explanation instead of a configuration that would not start.

Post-quantum key exchange

Guideline 6.0 puts X25519MLKEM768 first in every profile. It is the hybrid of ML-KEM-768 and X25519 standardized in RFC 10024, and current browsers and CDNs negotiate it by default. A group list that names a group the software cannot parse makes many servers refuse to start, while a list that leaves it out silently turns post-quantum key exchange off. So the generator writes the group only where the version can name it: OpenSSL 3.5 for nginx, Apache, HAProxy and the other OpenSSL-based servers, Go 1.24 and Caddy 2.10, Traefik 3.5, JDK 27 for Java servers, Node.js 24.5 or 22.20. Where a server cannot name groups but its library offers the hybrid by default, the configuration keeps that default, and the result says which case applies. The "all hybrids" option adds SecP256r1MLKEM768 and SecP384r1MLKEM1024, built only from NIST-approved components, for servers that need them. How the hybrid works inside the handshake is shown step by step in the illustrated TLS 1.3 handshake and explained in X25519MLKEM768 explained.

HSTS and OCSP stapling

HSTS (RFC 6797) is on by default with a two-year max-age and includeSubDomains, which makes browsers refuse plain HTTP on every subdomain; the notes remind you to check that all of them serve HTTPS. OCSP stapling is off by default: since ballot SC-063 publicly trusted CAs may stop running OCSP responders, and a certificate without an OCSP URL cannot be stapled. The notes also carry the guideline's certificate advice and the maximum lifetime of public certificates on the day you generate the configuration (CA/B Forum ballot SC-081) — see the 47-day certificate calculator for the full schedule.

Explain my config

The second tab reads an nginx or Apache httpd configuration you already run. It follows server blocks and virtual hosts, applies inheritance from the http block or the server configuration, fills unset directives with the defaults of your nginx or httpd version, and evaluates cipher strings the way OpenSSL 3 builds its list, so HIGH:!aNULL turns into the exact suites a client may be offered. Findings are graded from critical (SSLv3, compression, a stapling setup that keeps httpd from starting) to informational, each with its line number. Include files are not followed: paste them too if they hold TLS settings.

What stays on your machine

Both modes run entirely in your browser; the page sends nothing anywhere. Configurations name the paths of the certificate and key files, never their contents, and the explainer refuses a pasted private key. A share link puts the settings — or the pasted configuration — after the # of the address, which browsers never send to a server. The settings line inside a generated configuration is the same kind of link.

To see what your browser negotiates today, use the post-quantum browser check; to check deployed servers, the bulk domain checker. The differences between the protocol versions are compared in TLS 1.2 vs TLS 1.3 and X25519MLKEM768 vs X25519.