A sound nginx TLS setup starts with a complete certificate chain, TLS 1.2/1.3, the correct hostname and repeatable external tests. An A+ grade also depends on HSTS, software versions and the public TLS terminator. A configuration snippet alone cannot guarantee a grade.
If a CDN or load balancer sits before nginx, a public scanner sees that endpoint’s TLS policy. Identify the public termination point first and inspect its certificate with s_client. The snippet below is a starting point when nginx itself serves HTTPS; paths and HSTS policy need adaptation. Consult the official nginx HTTPS guide and SSL module.
What the external test observes
| Check | Typical issue | Evidence |
|---|---|---|
| Name and chain | Wrong SAN or missing intermediate | External TLS client and SSL scan |
| Protocols | Obsolete TLS version on the edge | Probe each supported version |
| Ciphers | Weak suites or old OpenSSL build | Scanner and library version |
| HSTS | Missing header or premature rollout | HTTP responses across the domain |
Do not copy a long cipher list from an old blog post. The Mozilla SSL Configuration Generator produces profiles for nginx/OpenSSL versions and client compatibility. A recent nginx may already have reasonable defaults, but includes and CDN settings still need inspection. For client-side failures, consult the curl 35/60 guide.
Annotated configuration and verification
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
add_header Strict-Transport-Security "max-age=300" always;
# location / { ... } remains application-specific.
}fullchain.pem includes the leaf and required intermediates; protect the private key through filesystem permissions. ssl_protocols restricts versions; TLS 1.3 support depends on the OpenSSL build. The short max-age=300 is a cautious HSTS rollout example, not a universal A+ value. Increase it only after checking all subdomains and access paths. includeSubDomains and preload can lock users out of unprepared hosts. See MDN’s HSTS guide.
Run nginx -t and retain a known-good config before reload. Then inspect the certificate and headers externally, including other security headers. If the test sees a CDN, change its policy; an origin-only change will not alter the public grade. Check IPv6, alternate names and redirects against DNS answers.
Before-and-after verification
nginx -t
curl -sSI https://example.com/ | sed -n '1,25p'
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/nullRun the same external scan before and after a change, saving both reports. CDN configuration can take time to deploy. A third-party rating follows its own method; report the actual scanner and date rather than promising A+ for every site. This article has no saved before-and-after grade for one host, and the sample is not presented as an enterno.io measurement.
A public TLS check on enterno.io
A control check on November 13, 2026 negotiated both TLS 1.2 and TLS 1.3. OpenSSL reported ECDHE-RSA-AES128-GCM-SHA256 for TLS 1.2 and TLS_AES_128_GCM_SHA256 for TLS 1.3; both returned Verify return code: 0 (ok). A header request returned HTTP/2 200, but the saved header sample had no HSTS. These are observations of the public enterno.io TLS endpoint, not an A+ rating or a claim about the origin nginx configuration. Commands and selected output are saved in the OCSP draft’s data.json.
How we made this guide
Directives were checked against nginx documentation and profile guidance against Mozilla. SerpAPI informed the search comparison. Wordstat region 225 had no estimate for the exact ssl a+ nginx phrase; the broader Russian query returned 52. Those counts inform wording, not security claims.
FAQ
Why did good nginx config not earn A+?
The scan may see a CDN, another IP, an outdated build, an incomplete chain or a different HSTS policy.
Should I enable HSTS preload?
Only after inventorying all subdomains and understanding its long-term effect. It is not a first diagnostic step.
Is TLS 1.3 alone enough?
No. Check client compatibility, certificate, chain and the public endpoint. TLS 1.2 is commonly retained.
Where do I change TLS with a CDN?
At the public TLS terminator. Test the CDN-to-origin connection separately.
