Learning nginx - SSL/TLS Security Hardening & Protocols (HTTP/2 & HTTP/3)

#Introduction

Having HTTPS is a must, but it isn't enough. Episode 9 made you safe; this Episode 10 makes you strong and fast. We'll cover SSL/TLS security hardening, plus the modern HTTP/2 and HTTP/3 protocols.

You'll enable HTTP/2, which multiplexes connections, set up HTTP/3 over UDP/QUIC, restrict TLS protocols to the strongest versions only, pick the right cipher suites, and turn on HSTS, OCSP stapling, and custom DH parameters. By the end of this episode, your TLS configuration will be ready for a security audit.

#Enabling Modern Protocols

#HTTP/2: Connection Multiplexing

HTTP/2 lets many requests run in parallel over a single TCP connection, eliminating the head-of-line blocking problem of HTTP/1.1:

server {
    listen 443 ssl http2;
    server_name example.com;
 
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

The http2 modifier on listen is enough to enable it. Modern browsers automatically negotiate HTTP/2 through ALPN during the TLS handshake.

#HTTP/3 (QUIC): Built on UDP

HTTP/3 is built on QUIC, which runs over UDP. It offers lower latency and smoother connection migration:

server {
    listen 443 ssl http2;
    listen 443 quic reuseport;
    server_name example.com;
 
    http3 on;
    ssl_early_data on;
    add_header Alt-Svc 'h3=":443"';
}

listen 443 quic reuseport; opens a UDP listener for QUIC, and http3 on; enables the protocol. The Alt-Svc header tells browsers that HTTP/3 is available on port 443.

#SSL Protocols and Cipher Suites

#Disable Obsolete Protocols

TLS 1.0 and TLS 1.1 have long been insecure. Only allow modern versions:

server {
    listen 443 ssl http2;
    server_name example.com;
 
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
}

ssl_protocols TLSv1.2 TLSv1.3; blocks old protocols. The chosen ciphers are all ECDHE and AES-GCM based, the fastest and strongest combination for modern hardware.

#Custom DH Parameters

Diffie-Hellman parameters affect the strength of the key exchange. Generate custom 2048-bit parameters:

sudo openssl dhparam -out /etc/nginx/dhparam.pem 2048

Then reference them in the server block:

server {
    listen 443 ssl http2;
    server_name example.com;
 
    ssl_dhparam /etc/nginx/dhparam.pem;
}

openssl dhparam -out /etc/nginx/dhparam.pem 2048 takes a few minutes, but the result is strong parameters unique to your server.

#HSTS (HTTP Strict Transport Security)

#Force Browsers to Always Use HTTPS

HSTS tells browsers never to use HTTP for that domain during a certain period:

server {
    listen 443 ssl http2;
    server_name example.com;
 
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
}

Strict-Transport-Security with max-age=63072000 (two years), includeSubDomains, and preload rules out downgrade attacks to HTTP. Since this header is sent by the HTTPS server, don't enable preload before every subdomain is confirmed to use HTTPS.

#OCSP Stapling

#Speed Up Certificate Verification

OCSP stapling lets the server include proof of certificate validity right in the handshake, so browsers don't need to ask the CA:

server {
    listen 443 ssl http2;
    server_name example.com;
 
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
}

ssl_stapling on; enables the feature and resolver specifies the DNS servers used to find the OCSP responder.

#Complete TLS Configuration

#Combining All Hardening

A single server block summarizing all the best practices:

server {
    listen 443 ssl http2;
    listen 443 quic reuseport;
    server_name example.com;
 
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_dhparam /etc/nginx/dhparam.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 8.8.8.8;
 
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
 
    http3 on;
    ssl_early_data on;
    add_header Alt-Svc 'h3=":443"';
}

Test the configuration with nginx -t, reload, and use curl -I https://example.com to make sure HTTP/2 and Alt-Svc appear in the response.

#Conclusion

Episode 10 completed the TLS security layer: you enabled HTTP/2 and HTTP/3, restricted protocols and ciphers to the strongest options, installed custom DH parameters, turned on HSTS and OCSP stapling, and summarized it all in one robust configuration.

Key takeaways:

• listen 443 ssl http2; enables HTTP/2; http3 on; enables HTTP/3.
• ssl_protocols TLSv1.2 TLSv1.3; blocks obsolete protocols.
• ECDHE and AES-GCM based ciphers are the best choice for modern hardware.
• ssl_dhparam strengthens the Diffie-Hellman key exchange.
• HSTS forces browsers to always use HTTPS for a certain period.
• OCSP stapling makes certificate verification faster and more secure.

In the next episode we'll discuss security hardening and rate limiting — hiding the NGINX version, IP-based access control, request and connection rate limiting, security headers, and body size limits for DDoS and brute-force mitigation.