NGINX TLS/SSL Hardening Prompt
Harden your NGINX TLS config to a modern, A-grade baseline — protocols, cipher suites, HSTS, OCSP stapling, session settings — without breaking older clients you actually need to support.
- Target user
- Engineers tightening NGINX TLS for compliance or an SSL Labs score
- Difficulty
- Advanced
- Tools
- Claude, ChatGPT, Cursor
The prompt
You are a senior security engineer who hardens NGINX TLS for production. You balance a strong cipher policy against real client compatibility, and you never enable HSTS preload without warning about its irreversibility.
I will provide:
- My current TLS-related directives (`ssl_protocols`, `ssl_ciphers`, certs, etc.): [PASTE TLS CONFIG]
- The oldest clients I must support (browsers, mobile, API clients, legacy integrations): [DESCRIBE CLIENTS]
- My OpenSSL/NGINX version: [PASTE nginx -V OUTPUT OR VERSION]
- Whether I want HSTS, and whether preload is acceptable: [DESCRIBE]
Harden it:
1. **Protocols** — set `ssl_protocols` to TLSv1.2 + TLSv1.3 (drop 1.0/1.1) unless a stated legacy client forbids it; if so, call out the exact risk.
2. **Ciphers** — give a modern `ssl_ciphers` list with `ssl_prefer_server_ciphers`, prioritizing AEAD/forward-secrecy suites; for TLS 1.3 note that ciphers are negotiated separately. Explain any suite you keep for compatibility.
3. **HSTS** — `add_header Strict-Transport-Security` with `max-age`, `includeSubDomains`, and `preload` ONLY if I confirmed it, with an explicit warning that preload is hard to undo.
4. **OCSP stapling** — `ssl_stapling on`, `ssl_stapling_verify on`, `ssl_trusted_certificate`, and a `resolver` with a timeout; explain what stapling does and how to verify it.
5. **Session + DH** — `ssl_session_cache`, `ssl_session_timeout`, disabling session tickets if forward secrecy matters, and `ssl_dhparam` guidance for non-ECDHE.
6. **Redirect + headers** — a clean HTTP→HTTPS redirect and a note on where security headers belong.
Output: (a) the hardened `server {}` TLS block, fully commented, (b) a compatibility note listing which clients you may drop, (c) verification commands: `nginx -t`, `openssl s_client -connect host:443 -status`, and what to look for. Apply only after `nginx -t` passes and reload; never hot-edit the live TLS config.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Why this prompt works
TLS hardening is a tradeoff, not a checklist — the strongest cipher policy is useless if it locks out a payment partner stuck on an old library. The prompt makes you state the oldest clients you must support up front, so the model tightens protocols and ciphers against real constraints and explicitly flags what it would drop.
HSTS preload and OCSP stapling are the two settings teams most often get wrong: preload is effectively irreversible, and stapling fails silently without a resolver. Forcing the model to warn on preload and include the ssl_stapling_verify + resolver lines prevents the two classic footguns.
The openssl s_client -status verification step turns an opaque config change into something you can prove. You see the negotiated protocol and the stapled OCSP response with your own eyes, behind an nginx -t gate, instead of trusting that a reload did what you hoped.
Related prompts
-
NGINX Config Security Audit Prompt
Audit an NGINX config for the classic misconfigurations — version leakage, missing security headers, open proxy, path traversal, exposed dotfiles — and get a prioritized fix list with exact directives, not a generic checklist.
-
Configure NGINX TLS, HSTS & OCSP Stapling Prompt
Build a modern, A-grade NGINX TLS configuration with correct protocol/cipher selection, OCSP stapling, session settings, and a safe HSTS rollout, then verify it against a real handshake.
-
NGINX HTTP/3 (QUIC) Reverse-Proxy Setup Prompt
Generate a correct, production-ready HTTP/3 + QUIC server block for an existing NGINX reverse proxy — UDP 443 listeners, Alt-Svc advertisement, congestion/retry settings, and TLS 1.3 — without breaking your working HTTP/2 fallback.
-
NGINX mTLS Client Certificate Auth Prompt
Configure mutual TLS so NGINX requires and verifies client certificates — for service-to-service or partner APIs — with correct CA trust, verification depth, and the right variables passed to your backend.
More NGINX prompts & error guides
Browse every NGINX prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.