Which profile is right?
The profiles decide which TLS versions and ciphers the server offers. The stricter, the more secure – but the fewer old clients get through.
- Recommended (TLS 1.2 + 1.3): fits almost every website and mail server. Only ciphers with forward secrecy and AEAD (GCM, ChaCha20). All browsers and operating systems from the last ten years connect.
- Modern (TLS 1.3 only): for services whose clients you know, e.g. APIs between your own systems or internal portals with current devices.
- Compatible: additionally allows CBC ciphers for very old clients such as Java 7, Windows 7 or embedded devices. TLS 1.0 and 1.1 stay off anyway; they have been considered insecure since 2021 (RFC 8996).
What the settings do
- ssl_prefer_server_ciphers off: all allowed ciphers are secure, so the client may pick the fastest for it, e.g. ChaCha20 on phones without AES acceleration.
- Session tickets off: without regularly rotated ticket keys they would undermine forward secrecy. The session cache handles reconnections instead.
- HSTS: browsers then only load the site over HTTPS. Start with the test value and raise it to two years once everything works. With “preload” the decision is practically final.
- OCSP stapling: the server delivers the revocation status along with the certificate. Many CAs, including Let’s Encrypt, have stopped OCSP; then the option does nothing except log warnings.
Mail servers are a special case
Between mail servers TLS is usually opportunistic: if the other side cannot do TLS or only old versions, mail is still delivered, unencrypted if need be. That is why the Postfix configuration does not enforce TLS on port 25. For mail clients logging in (Dovecot, port 587/993), TLS is mandatory.
After deploying, check the result in the SSL check (STARTTLS for port 25 too), the headers in the security header check and the protocols in the HTTP/2 & HTTP/3 check.
FAQ
Can I really switch off TLS 1.0 and 1.1?
Yes. All major browsers removed them in 2020 and RFC 8996 deprecates them. Only very old devices and programs are affected, such as Windows XP, Android 4.3 or Java 6.
Why are there no ciphers in the “Modern” configuration?
TLS 1.3 only has five cipher suites, all secure. Servers choose them themselves; a cipher list as with TLS 1.2 is not needed.
Do I still need a dhparam file?
No. The profiles only use elliptic-curve key exchange (ECDHE). Classic Diffie-Hellman (DHE), and therefore a dhparam file, is not needed.
What is different with IIS?
Windows does not configure TLS per website but for the whole server via SCHANNEL in the registry. The script changes that and must run as administrator; a restart is required. It also affects RDP, SQL Server and other services on the server.
Is my input sent anywhere?
No, the configuration is created entirely in your browser. Only the test links open the respective tools with your domain.