DEV Community

Ramer Labs
Ramer Labs

Posted on

7 Tips for Hardening TLS and HTTP/2 on Nginx for Production

#nginx #security #performance #linux

Introduction

Transport Layer Security (TLS) is the cornerstone of any modern web service. When you pair it with HTTP/2, you get lower latency, multiplexed streams, and better overall performance. However, a mis‑configured TLS stack can become an attack surface. This guide walks you through seven concrete steps to lock down TLS and HTTP/2 on an Nginx server that’s serving real traffic.

1. Use Modern Protocols Only

Older protocol versions (SSLv2, SSLv3, TLS 1.0/1.1) are riddled with known exploits. Force Nginx to speak TLS 1.2 and TLS 1.3 only.

ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on;
Enter fullscreen mode Exit fullscreen mode

If you need to support legacy browsers, terminate TLS at a load balancer or CDN and keep the backend strictly modern.

2. Adopt a Strong Cipher Suite

A good cipher suite balances security with performance. The following list is widely recommended by Mozilla’s SSL Configuration Generator:

ssl_ciphers \ "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256" \ "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384" \ "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256";
Enter fullscreen mode Exit fullscreen mode
  • Why these ciphers?
    • They all provide forward secrecy (ECDHE).
    • No RC4, DES, or 3DES.
    • They are hardware‑accelerated on most CPUs.

3. Enable HTTP/2 and Optimize Its Settings

HTTP/2 is enabled with a single directive, but you can fine‑tune its behaviour.

listen 443 ssl http2; # Optional tweaks http2_max_concurrent_streams 128; http2_keepalive_timeout 30s;
Enter fullscreen mode Exit fullscreen mode
  • http2_max_concurrent_streams caps the number of parallel streams per connection, preventing a single client from starving others.
  • http2_keepalive_timeout reduces idle connection waste.

4. Deploy OCSP Stapling

OCSP stapling saves a round‑trip for the client and hides your certificate‑authority queries from the public.

ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s;
Enter fullscreen mode Exit fullscreen mode

Make sure the resolver points to a reliable DNS server; otherwise stapling will fail and browsers may fall back to a full OCSP request.

5. Enforce HSTS (HTTP Strict Transport Security)

HSTS tells browsers to only ever talk HTTPS to your domain for a defined period.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
Enter fullscreen mode Exit fullscreen mode
  • max-age=31536000 – one year.
  • includeSubDomains – protects all sub‑domains.
  • preload – lets you submit the domain to the Chrome preload list for even stricter enforcement.

Caution: Once you enable preload, removing it is a multi‑month process. Test carefully on a staging environment first.

6. Harden the Underlying Linux Host

TLS is only as strong as the OS it runs on.

  • Firewall – block all inbound ports except 80/443. 
 sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw enable
Enter fullscreen mode Exit fullscreen mode
  • Fail2Ban – automatically ban IPs that repeatedly fail TLS handshakes or try common attacks. 
 [nginx-http-auth] enabled = true filter = nginx-http-auth logpath = /var/log/nginx/error.log maxretry = 5 bantime = 3600
Enter fullscreen mode Exit fullscreen mode
  • Automatic Security Updates – on Debian/Ubuntu, enable unattended upgrades. 
 sudo apt-get install unattended-upgrades sudo dpkg-reconfigure unattended-upgrades
Enter fullscreen mode Exit fullscreen mode

7. Automate Certificate Renewal

Let’s Encrypt makes free, trusted certificates easy, but you must renew them before they expire. Use certbot with a systemd timer.

# Install certbot for Nginx sudo apt-get install certbot python3-certbot-nginx # Obtain a certificate (replace example.com) sudo certbot --nginx -d example.com -d www.example.com # Verify renewal works sudo certbot renew --dry-run
Enter fullscreen mode Exit fullscreen mode

Certbot drops a systemd timer (certbot.timer) that runs twice daily, so you never have to think about it again.

Putting It All Together

Below is a minimal yet production‑ready Nginx server block that incorporates the previous recommendations.

server { listen 80 default_server; listen [::]:80 default_server; server_name example.com www.example.com; return 301 https://$host$request_uri; } server { listen 443 ssl http2; server_name example.com www.example.com; # TLS basics ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"; # OCSP stapling ssl_stapling on; ssl_stapling_verify on; resolver 1.1.1.1 1.0.0.1 valid=300s; resolver_timeout 5s; # HSTS add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; # Root & logging root /var/www/html; access_log /var/log/nginx/example.access.log; error_log /var/log/nginx/example.error.log; location / { try_files $uri $uri/ =404; } }
Enter fullscreen mode Exit fullscreen mode

Deploy the block, reload Nginx (sudo systemctl reload nginx), and run a quick SSL test with Qualys SSL Labs or openssl s_client -connect example.com:443 -servername example.com.

Conclusion

Hardening TLS and HTTP/2 on Nginx isn’t a one‑off checklist; it’s an ongoing discipline. By locking down protocols, ciphers, and the host OS, you dramatically reduce the attack surface while still reaping HTTP/2’s performance gains. Remember to monitor certificate expiry, keep your OS patched, and periodically review your cipher suite against emerging cryptographic research.

If you’re looking for a reliable partner to audit or host your hardened Nginx deployments, consider checking out https://lacidaweb.com for practical advice and managed services.

Top comments (0)