Gratuit · Réseau et infrastructure IT
Générateur de configuration TLS / SSL.
Générez une configuration HTTPS sécurisée pour Nginx, Apache, HAProxy et Caddy : TLS 1.2/1.3, chiffrements à confidentialité persistante, HSTS, HTTP/2 et HTTP/3.
Configuration
server {
listen 80;
listen [::]:80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
add_header Strict-Transport-Security "max-age=63072000" always;
}- TLS 1.2 is limited to forward-secret AEAD cipher suites (ECDHE with AES-GCM or ChaCha20-Poly1305). TLS 1.3 suites are all modern and need no list.
- Session tickets are off so that a stolen ticket key cannot decrypt past sessions; session caching keeps resumption fast.
- OCSP stapling is omitted: Let’s Encrypt stopped OCSP in 2025 and browsers rely on other revocation mechanisms. Add it if your CA still provides OCSP.
- Verify after reloading with testssl.sh or an online TLS scanner.
Comment utiliser cet outil: Générateur de configuration TLS / SSL
Saisissez ou sélectionnez vos données. Réglez les options, générez le résultat puis vérifiez-le avant de le copier ou de le télécharger.
Limites et formats acceptés
Vos données sont traitées sur votre appareil.
Notes techniques en anglais
Original configuration following current best practice; verify with testssl.sh or a TLS scanner. Post-quantum hybrid key exchange needs OpenSSL 3.5 or later. Everything is calculated in your browser; nothing is sent or probed on the network.
The profile chooses protocol versions and, for TLS 1.2, AEAD cipher suites with ECDHE key exchange; the rest of the file adds certificates, redirects, session settings and headers in each server’s syntax.
The intermediate profile for Nginx enables TLS 1.2 and 1.3 with ECDHE AES-GCM and ChaCha20 suites, disables session tickets and redirects HTTP to HTTPS.