A short checklist for TLS 1.3 on nginx

Enabling TLS 1.3 on nginx is mostly a matter of not getting in the way. This is the checklist we use when reviewing a server.

• Confirm that nginx is built against OpenSSL 1.1.1 or newer and that ssl_protocols lists TLSv1.2 and TLSv1.3. Dropping TLS 1.0 and 1.1 is safe for any current browser.
• Leave ssl_ciphers alone unless you have a concrete reason. TLS 1.3 ciphersuites are not configured through that directive, and the TLS 1.2 defaults are sensible.
• Serve the full certificate chain. A missing intermediate works in some browsers and fails in others, which makes the problem look intermittent.
• Enable HTTP/2 on the same listener. Clients negotiate both in a single handshake through ALPN.
• Renew certificates automatically and alert on expiry. A renewal job that silently fails is the most common cause of outages we see.

Finally, test from outside your own network. openssl s_client -connect host:443 -tls1_3 prints the negotiated protocol, and an online scanner will catch chain and hostname mistakes that a local test hides.