TLS on nginx terminates HTTPS: point ssl_certificate at a full chain and ssl_certificate_key at the private key. Choose protocols and ciphers from a maintained profile (for example Mozilla intermediate). ssl_stapling staples OCSP responses—configure ssl_trusted_certificate and a resolver so nginx can refresh responses. Enable HTTP/2 on TLS listeners when clients support it; HTTP/3 needs a separate quic listener where supported.
| Topic | Directive | Risk if wrong |
|---|---|---|
| Chain completeness | ssl_certificate fullchain | Some clients fail trust checks |
| OCSP stapling | ssl_stapling + resolver | Slow handshakes or stapling failures |
| Session reuse | ssl_session_cache | Higher CPU if cache too small |
Related
security headers, server blocks, performance tuning, reverse proxy