Frequently asked questions
Which web servers does the SSL config generator support?
It generates hardened TLS configuration for Nginx, Apache, Caddy and HAProxy, with Modern, Intermediate and Legacy profiles based on the Mozilla SSL configuration guidelines.
What is the difference between Modern, Intermediate and Legacy profiles?
Modern enables only TLS 1.3 for maximum security but drops older clients; Intermediate supports TLS 1.2 and 1.3 for broad compatibility and is the recommended default; Legacy adds older protocols for very old clients and should be avoided unless you must support them.
Does the generated config include HSTS and OCSP stapling?
Yes. You can enable HSTS (with optional preload), OCSP stapling, HTTP/2 and an automatic HTTP-to-HTTPS redirect, and the output includes secure cipher suites and protocol settings for your chosen profile.
Will this configuration get me an A or A+ grade?
The Intermediate and Modern profiles are designed to score highly, and enabling HSTS with a long max-age typically pushes a correct deployment to A+. Re-scan with our SSL checker after deploying to confirm.
Is it safe to use these configs in production?
The profiles follow current best practice, but always test in staging first, make sure your certificate paths are correct, and confirm your client base supports the chosen TLS versions before rolling out.