Implementing SSL/TLS Configuration
1. Configuring SSL Certificates
| Type | Use |
|---|
| DV (Domain Validation) | Free, automated (Let's Encrypt) |
| OV (Organization) | Org identity verified |
| EV (Extended) | Legal entity check |
| Wildcard | *.example.com |
| SAN/Multi-domain | Multiple FQDNs |
Example: NGINX SSL config
server {
listen 443 ssl http2;
ssl_certificate /etc/ssl/fullchain.pem;
ssl_certificate_key /etc/ssl/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
}
2. Setting TLS Protocol Versions
| Version | Status |
|---|
| TLS 1.3 | Preferred (0-RTT, simpler) |
| TLS 1.2 | Allowed (broad compat) |
| TLS 1.1 DEPRECATED | Disable |
| TLS 1.0 DEPRECATED | Disable (PCI requires) |
| SSL 3.0 DEPRECATED | Disable (POODLE) |
3. Configuring Cipher Suites
| Suite | Notes |
|---|
| TLS_AES_256_GCM_SHA384 | TLS 1.3 strong |
| TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 mobile fast |
| ECDHE-ECDSA-AES128-GCM-SHA256 | TLS 1.2 modern |
| RC4, 3DES, MD5 | Disable |
4. Implementing Mutual TLS (mTLS)
Example: NGINX mTLS
ssl_client_certificate /etc/ssl/ca.crt;
ssl_verify_client on;
ssl_verify_depth 2;
# Forward client cert info
proxy_set_header X-Client-Cert-CN $ssl_client_s_dn;
proxy_set_header X-Client-Cert-Verify $ssl_client_verify;
5. Setting Up Certificate Pinning
| Method | Notes |
|---|
| HPKP DEPRECATED | Browser removed |
| App-level pin | Mobile apps (recommended) |
| Pin SPKI hash | Survives cert renewal |
| Backup pin | Always include 2+ |
6. Configuring SNI (Server Name Indication)
| Property | Detail |
|---|
| Multi-cert per IP | Pick cert by hostname |
| SNI in ClientHello | Not encrypted (TLS 1.2) |
| ECH (Encrypted ClientHello) | Hides SNI NEW |
| SNI required | Reject if absent |
7. Implementing Certificate Rotation
Cert Rotation Flow
- Provision new cert (30d before expiry)
- Deploy to staging, validate
- Update load balancer / gateway config
- Graceful reload (
nginx -s reload)
- Verify with
openssl s_client
- Update monitoring with new expiry
8. Setting Up OCSP Stapling
| Setting | Purpose |
|---|
ssl_stapling on | Enable |
ssl_stapling_verify on | Validate OCSP response |
resolver | DNS for OCSP responder |
| Must-Staple | Cert extension forces stapling |
9. Configuring SSL Session Caching
| Method | Notes |
|---|
| Session ID cache | Server-side, shared mem |
| Session tickets | Client-side, stateless |
| TLS 1.3 PSK | 0-RTT resumption |
Warning: Disable session tickets or rotate ticket keys daily — old keys break forward secrecy.
10. Using Let's Encrypt Integration
Example: Certbot with auto-renewal
certbot --nginx -d api.example.com -d www.api.example.com \
--email ops@example.com --agree-tos --no-eff-email \
--deploy-hook "systemctl reload nginx"
# Cron: auto-renew (Certbot installs systemd timer)
0 */12 * * * certbot renew --quiet
| Tool | Use |
|---|
| Certbot | Most common, plugins |
| acme.sh | Lightweight shell |
| cert-manager | Kubernetes native |
| Caddy | Auto HTTPS built-in |