The security of data transmitted over the web is mandatory for any serious business. The basic use of HTTPS certificates (like Let's Encrypt) is already common, but the default configuration of the Nginx web server often accepts old and insecure encryption ciphers and protocols for compatibility reasons.
In this network engineering tutorial, we show you how to perform SSL/TLS protocol *hardening* on Nginx to secure your connections and achieve the maximum grade (A+) in the global security test by Qualys SSL Labs.
1. Disabling Obsolete Protocols (TLS 1.0 and 1.1)
Legacy protocols like SSLv3, TLS 1.0, and TLS 1.1 have known flaws (such as POODLE and BEAST). We must only accept connections based on TLS 1.2 and TLS 1.3 versions.
In the Nginx configuration `server` block:
```nginx ssl_protocols TLSv1.2 TLSv1.3; ```2. Defining Strong Encryption Ciphers
Avoid ciphers based on vulnerable encryption algorithms, such as RC4 or 3DES. Modern ciphers with secure key exchange using elliptic curves (ECDHE) are more robust and faster.
```nginx
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
```
3. Implementing HSTS (Strict Transport Security)
HSTS is an HTTP response header that instructs the browser to force any future connection strictly via HTTPS, preventing Man-in-the-Middle interception attacks during HTTP-to-HTTPS redirects.
Add the line in Nginx:
```nginx add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; ```4. Performance Optimization (Session Resumption and OCSP)
Encrypting connections consumes CPU processing. Optimize these handshakes to ensure the end-user's browsing experience remains fast:
```nginx
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
```
```nginx
ssl_stapling on;
ssl_stapling_verify on;
```
Conclusion
Configuring SSL/TLS in an optimized manner protects your customers' sensitive data (such as credit cards and login details) and helps with the site's organic SEO positioning. By implementing these policies on your Nginx server, you ensure the highest level of data integrity in the market.