Your files stay on your device

# TLS configuration generator

Pick a security profile and a server product and get a ready TLS configuration block, with what each profile gives up stated up front.

Enter a hostname to generate the configuration.

This generator writes configuration and stops there. It never connects to a host, so it cannot tell you what is actually deployed: run a checker against the live site after you apply the block. Session tickets are turned off where the server allows it because tickets trade away some forward secrecy across restarts, and the session cache covers resumption instead. Under TLS 1.3 the client picks the cipher suite, so no server-side cipher order is set. Kestrel has no stapling switch and its cipher policy applies on Linux only, Node cannot staple at all, and IIS protocol versions live in the SChannel registry keys rather than web.config. The profiles follow Mozilla's Server Side TLS guidance.
Options

## More config file tools

- [nginx.conf explainer](/config/nginx)
- [SSH config explainer](/config/ssh)
- [Port reference](/network/ports)
[All config file tools](/config)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/config/tls-configuration-generator
Markdown version: https://nutter.tools/config/tls-configuration-generator.md
Plain-text version: https://nutter.tools/config/tls-configuration-generator.txt
Agent index: https://nutter.tools/llms.txt