How is this different from the SSL Certificate Decoder tool?

The SSL Certificate Decoder reads and displays the contents of an existing X.509 certificate you already have (subject, issuer, expiry, and so on). This tool does the opposite job: it generates the TLS configuration a server uses to negotiate connections in the first place, protocol versions and cipher suites, nothing to do with reading a certificate file.

What's the difference between the Modern, Intermediate, and Old profiles?

Modern supports only TLS 1.3, the strongest security and best performance, but only works with quite recent clients. Intermediate supports TLS 1.2 and 1.3 with a strong cipher suite list, Mozilla's general recommendation for most public-facing services balancing security and broad compatibility. Old adds TLS 1.0/1.1 and a much wider (weaker) cipher list, only for services that must support legacy clients that can't be upgraded.

Are these cipher suite strings guaranteed to be exactly what Mozilla currently recommends?

They reflect Mozilla's SSL Configuration Generator guidelines as commonly published, but Mozilla does periodically revise its recommendations as the threat landscape changes. Cross-check the output against the live generator at ssl-config.mozilla.org before deploying to a system you can't easily update later.

Why does the Modern profile have no ciphers line for some servers?

TLS 1.3 uses a small, fixed set of cipher suites (all considered strong) and doesn't support the older CBC/RC4-style ciphers TLS 1.2 configuration lines control. Since the Modern profile is TLS 1.3-only, there's no legacy cipher suite string to configure, only the TLS 1.3 ciphersuite directive where the server supports customizing it.

SSL/TLS Config Generator - Nginx, Apache, HAProxy, Caddy

Overview

Introduction

Configuring a server's TLS protocol versions and cipher suites correctly by hand means either trusting an old blog post's cipher string or manually working through Mozilla's guidelines every time you set up a new server.

This tool generates that configuration directly: pick your server and a Modern/Intermediate/Old profile, and get the protocol, cipher, and session settings as a ready-to-paste snippet.

What Is SSL/TLS Config Generator?

A TLS hardening config generator covering four server targets (Nginx, Apache, HAProxy, Caddy) and Mozilla's three standard profiles (Modern, Intermediate, Old), each with its own protocol version list and cipher suite string.

It outputs the specific directives each server uses to configure TLS: ssl_protocols/ssl_ciphers for Nginx, SSLProtocol/SSLCipherSuite for Apache, ssl-min-ver/ssl-default-bind-ciphers for HAProxy, and a tls block for Caddy.

How SSL/TLS Config Generator Works

Each profile maps to a fixed set of supported protocol versions and cipher suite strings (TLS 1.3 ciphersuites plus, for Intermediate and Old, a TLS 1.2 cipher list), matching Mozilla's published guidance for that profile.

Selecting a server wraps those values in that server's actual configuration directive syntax, so switching servers with the same profile keeps the underlying protocol/cipher choices identical, only the surrounding syntax changes.

When To Use SSL/TLS Config Generator

Use it when hardening a new server's TLS configuration, or reviewing an existing one against Mozilla's current recommended profiles.

It's also useful when migrating a TLS setup from one web server to another and wanting to preserve the same security profile.

Often used alongside HTTP Security Headers Generator, SSH Config File Generator and CSP Header Generator.

Features

Advantages

Encodes Mozilla's specific, widely trusted profile recommendations instead of requiring you to look them up and transcribe them by hand.
Covers four different servers with their real configuration directive names and syntax.
Makes the security/compatibility tradeoff explicit via the three named profiles, rather than a single one-size-fits-all cipher list.

Limitations

Cipher suite recommendations do change over time; always cross-check against the live Mozilla SSL Configuration Generator before deploying to a long-lived production system.
Doesn't cover other important TLS hardening steps (OCSP stapling, HSTS, certificate configuration itself), only protocol/cipher/session settings.

Examples

Intermediate profile for Nginx

Input

server: Nginx, profile: Intermediate

Output

# Mozilla intermediate profile
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...';
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;

TLS 1.2 and 1.3 are both enabled, with the TLS 1.2 cipher list set via ssl_ciphers and the TLS 1.3 suites set separately via ssl_conf_command, matching how Nginx actually separates the two.

Best Practices & Notes

Best Practices

Default to the Intermediate profile unless you have a specific, verified reason to need Old (legacy client support) or can confirm Modern (TLS 1.3-only) won't break any client you care about.
Re-run this generator periodically and diff against your live config, Mozilla's recommendations shift as weak ciphers and protocol versions are deprecated over time.
Combine a hardened TLS config with HSTS (see the HTTP Security Headers Generator) so clients are directed to use HTTPS at all going forward.

Developer Notes

Each Mozilla profile is stored as a fixed { protocols, ciphersuites, ciphers } record; server-specific output wraps these values in that server's real directive syntax (Nginx's ssl_conf_command for TLS 1.3 ciphersuites specifically, since ssl_ciphers only covers the TLS 1.2-and-below cipher list in Nginx's own architecture).

SSL/TLS Config Generator Use Cases

Hardening TLS settings on a new server deployment
Auditing an existing server's TLS configuration against Mozilla's current recommended profiles
Migrating a TLS hardening setup from one web server/proxy to another

Common Mistakes

Using the Old profile by default for convenience or compatibility, without confirming any client actually still requires TLS 1.0/1.1 or the weaker legacy ciphers it includes.
Copying a cipher suite string from an old tutorial instead of a current source, weak ciphers get deprecated and old recommendations go stale.

Tips

Cross-check the generated cipher strings against the live Mozilla SSL Configuration Generator (ssl-config.mozilla.org) before applying to a production system you can't quickly roll back.

SSL/TLS Config Generator