Your files stay on your device

TLS configuration generator

Pick a security profile and a server product and get a ready TLS configuration block, with what each profile gives up stated up front.

Enter a hostname to generate the configuration.

This generator writes configuration and stops there. It never connects to a host, so it cannot tell you what is actually deployed: run a checker against the live site after you apply the block. Session tickets are turned off where the server allows it because tickets trade away some forward secrecy across restarts, and the session cache covers resumption instead. Under TLS 1.3 the client picks the cipher suite, so no server-side cipher order is set. Kestrel has no stapling switch and its cipher policy applies on Linux only, Node cannot staple at all, and IIS protocol versions live in the SChannel registry keys rather than web.config. The profiles follow Mozilla's Server Side TLS guidance.

Profile and server

Compatibility profileWhat each profile gives up is stated in the result

Server product

HostnameLetters, digits, dots and hyphens only, up to 253 characters. IDN domains go in as punycode.

More settings

Redirect HTTP to HTTPSA port 80 listener or rule that sends everything to https

Include HSTSStrict-Transport-Security with a one year max-age

Enable OCSP staplingOnly where the server supports it; see the CA note in the result

HSTS starts on a low max-age for new domains. OCSP stapling is fading as certificate authorities drop it, so the generated directives may do nothing depending on your CA.

Certificate file paths default to a Let's Encrypt layout; point them at your own files. No old profile is offered: TLS 1.0, TLS 1.1, RC4, 3DES and static RSA are deprecated or broken.

All config file tools

Was this tool useful?

TLS configuration generator

More config file tools