Turn off old encryption

How to do it

Copy the "intermediate" profile from Mozilla's SSL configuration generator for your server and version. Offer the hybrid post-quantum key exchange X25519MLKEM768 first, where your TLS library supports it, for example OpenSSL 3.5 or later. Use RSA keys of at least 2048 bits or ECDSA P-256 keys. Turn on OCSP stapling only if your authority still runs OCSP. Let's Encrypt stopped in 2025.

Example

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;   # needs OpenSSL 3.5+
ssl_prefer_server_ciphers off;
ssl_early_data off;
# Only if your certificate has an OCSP address (Let's Encrypt ones don't)
# ssl_stapling on;
# ssl_stapling_verify on;

How to check

curl --tlsv1.1 --tls-max 1.1 --ciphers 'DEFAULT@SECLEVEL=0' https://example.com/ fails. Without that cipher flag, OpenSSL 3 refuses TLS 1.1 on its own side. testssl.sh reports no weak ciphers and no known flaws.