---
title: "Turn off old encryption · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration
id: APS-55
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 867
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Turn off old encryption

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-55
- Level: Recommended
- Chapter: [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)
- Rule: Allow only TLS 1.2 and 1.3, with ECDHE key exchange and AEAD ciphers. Turn off TLS compression and 0-RTT for requests that change data.
- Check: `curl --tlsv1.1 --tls-max 1.1 --ciphers 'DEFAULT@SECLEVEL=0' https://example.com/` fails. Without that cipher flag, OpenSSL 3 refuses TLS 1.1 on its own side. `testssl.sh` reports no weak ciphers and no known flaws.
- How: Copy the "intermediate" profile from Mozilla's SSL configuration generator for your server and version. Offer the hybrid post-quantum key exchange `X25519MLKEM768` first, where your TLS library supports it, for example OpenSSL 3.5 or later. Use RSA keys of at least 2048 bits or ECDSA P-256 keys. Turn on OCSP stapling only if your authority still runs OCSP. Let's Encrypt stopped in 2025.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### nginx example

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;   # needs OpenSSL 3.5+
ssl_prefer_server_ciphers off;
ssl_early_data off;
# Only if your certificate has an OCSP address (Let's Encrypt ones don't)
# ssl_stapling on;
# ssl_stapling_verify on;
```

## Sources

- [RFC 9325 (Recommendations for Secure Use of TLS)](https://www.rfc-editor.org/rfc/rfc9325)
- [RFC 10015 (Deprecating Obsolete Key Exchange Methods in TLS 1.2)](https://www.rfc-editor.org/rfc/rfc10015)
- [NIST SP 800-52 Rev. 2 (TLS Guidelines)](https://csrc.nist.gov/pubs/sp/800/52/r2/final)

## Related rules

- APS-54 [Encrypt data on the wire and on disk](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/encrypt-data.md) in Application security
- APS-59 [Prepare your encryption for quantum computers](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/post-quantum-readiness.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Encrypt data on the wire and on disk](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/encrypt-data.md)
- Next: [Renew certificates automatically](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/certificate-renewal.md)
- [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)