Nginx · The edge of your stack

How do you configure TLS termination in Nginx?

MediumtlssslcertificatesUpdated Oct 2026

Short answer

Configure listen 443 ssl with a certificate chain and private key, restrict protocols to TLS 1.2 and 1.3, enable session reuse and OCSP stapling, and add HSTS only after HTTPS is verified.

Nginx terminates TLS, decrypts the request, and forwards plain HTTP to the backend unless you explicitly re-encrypt. The certificate file should include the full chain so clients can verify it without missing intermediates.

nginx

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    resolver 1.1.1.1 1.0.0.1 valid=300s;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    ssl_stapling on;
    ssl_stapling_verify on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://app;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Operational details

Use fullchain.pem, not only the leaf certificate
Keep the private key readable only by the master process
TLS 1.2 and 1.3 are the practical minimum; disable SSLv3 and TLS 1.0 or 1.1
Session cache and tickets reduce handshake cost for returning clients
HSTS tells browsers to use HTTPS for future requests and is hard to undo

Reload after certificate renewal. If you enable HSTS preload or a long max-age, a certificate problem can lock users out, so monitor expiry and keep an emergency issuance path.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

1Why must the certificate file contain the full chain?
2What does ssl_prefer_server_ciphers off mean with TLS 1.3?
3How do you safely roll out HSTS?
4Should Nginx re-encrypt traffic to the backend?

Say it in the interview

I terminate TLS in a 443 server block with the full certificate chain and private key. I allow TLS 1.2 and newer with session caching and OCSP stapling. I add HSTS only once HTTPS is stable, forward X-Forwarded-Proto so the app knows the original scheme, and monitor renewal expiry because HSTS makes mistakes costly.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Nginx mock interview and get scored feedback on depth, clarity and confidence.

Start a free Nginx interview Browse all questions

Operational details

Follow-ups you should expect

Related questions

Now say it out loud.