Enable TLS 1.3 on nginx

Why it matters

TLS 1.3 is faster to connect and removes older, weaker options, and every current browser supports it. Your server only offers TLS 1.2, which is safe today but below the common modern baseline.

The fix

1. nginx supports TLS 1.3 from 1.13.0 when built with OpenSSL 1.1.1 or later (nginx -V shows the build). Update if it is older.
2. Find every existing line with grep -Rn ssl_protocols /etc/nginx /etc/letsencrypt. A server-level line (including certbot's options-ssl-nginx.conf) overrides http, so add TLSv1.3 to each existing ssl_protocols line, then test and reload.

ssl_protocols TLSv1.2 TLSv1.3;

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Turn off TLS 1.0 and 1.1
• Enable TLS 1.2 and TLS 1.3