---
title: "Turn off old encryption · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network/tls-configuration
updated: 2026-10-20
licence: "All rights reserved"
---

# Turn off old encryption

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Rule: Allow only TLS 1.2 and 1.3, with ECDHE key exchange and AEAD ciphers. Turn off TLS compression and 0-RTT for requests that change data.
- How: Copy the "intermediate" profile from Mozilla's SSL configuration generator for your server and version. Offer the hybrid post-quantum key exchange `X25519MLKEM768` first, where your TLS library supports it, for example OpenSSL 3.5 or later. Use RSA keys of at least 2048 bits or ECDSA P-256 keys. Turn on OCSP stapling only if your authority still runs OCSP. Let's Encrypt stopped in 2025.
- Check: `curl --tlsv1.1 --tls-max 1.1 --ciphers 'DEFAULT@SECLEVEL=0' https://example.com/` fails. Without that cipher flag, OpenSSL 3 refuses TLS 1.1 on its own side. `testssl.sh` reports no weak ciphers and no known flaws.

Example:

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;   # needs OpenSSL 3.5+
ssl_prefer_server_ciphers off;
ssl_early_data off;
# Only if your certificate has an OCSP address (Let's Encrypt ones don't)
# ssl_stapling on;
# ssl_stapling_verify on;
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/tls-configuration`.

- Previous: [Serve everything over HTTPS](https://agentwranglers.se/playbook/website/hosting-and-network/https-tls)
- Next: [Serve over HTTP/2 or HTTP/3](https://agentwranglers.se/playbook/website/hosting-and-network/http3)
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)