Current nginx defaults are reasonable: TLS 1.2 and 1.3 only, tickets on, stapling off, early data off. Most sites need little more than a certificate. The settings that deserve a conscious decision are session tickets, OCSP stapling and 0-RTT early data, and only the last one has replay risk.
The defaults
From the nginx ssl module documentation:
| Directive | Default |
|---|---|
| ssl_protocols | TLSv1.2 TLSv1.3 |
| ssl_prefer_server_ciphers | off |
| ssl_session_tickets | on |
| ssl_session_timeout | 5m |
| ssl_stapling | off |
| ssl_reject_handshake | off |
| ssl_early_data | off |
TLSv1.3 has been in the default list since nginx 1.23.4. If your config predates that and lists protocols explicitly, it may still include old versions. Read the protocol list in your own files rather than assuming. Our guides on disabling TLS 1.0 and 1.1 and the RFC 9325 baseline cover the reasoning.
Session tickets
Tickets let clients resume sessions without a full handshake (RFC 5077). They are on by default. The trade off is the ticket key: if it is long lived or shared across servers carelessly, it weakens forward secrecy, because anyone who obtains the key can decrypt recorded sessions that used it. The details of forward secrecy are in our explainer. I did not fetch nginx's key rotation guidance, so check the current docs on ticket keys before running a multi server pool. If you cannot rotate keys, turning tickets off is the conservative choice.
OCSP stapling
Stapling is off by default. When on, the server includes a signed revocation status with the handshake. The docs say it requires the issuer certificate to be known, either in the ssl_certificate chain or in ssl_trusted_certificate, and a resolver. Revocation practice has changed, though. See OCSP ended at Let's Encrypt before spending time on it. If your issuer no longer supports OCSP, stapling gives you nothing.
Early data (0-RTT)
ssl_early_data is off. The docs say early data is replayable, so you should check $ssl_early_data at the application layer, and that OpenSSL's built-in anti replay is disabled by default. Leave it off unless you have measured a need and your application treats early data requests as idempotent only. The risks are explained in TLS 1.3 0-RTT replay.
Multiple certificates
ssl_certificate can be repeated since 1.11.0, for example one RSA and one ECDSA, so modern clients get the smaller one. Within a file, the primary certificate comes first, then intermediates. A wrong order is a frequent cause of trust errors, which you can check with openssl s_client.
Short checklist
- Print the effective config with
nginx -Tand read every ssl line. - Confirm protocols are TLS 1.2 and 1.3.
- Decide on tickets and key rotation.
- Skip stapling unless your issuer supports it.
- Keep early data off by default.
- Add a catch-all with ssl_reject_handshake, see the default server post.
Where Safeguard fits
Safeguard does not tune TLS settings. It scans the dependencies and container images that include your TLS library, and tracks advisories. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Is OCSP stapling on by default in nginx?
No, ssl_stapling defaults to off.
Why is early data off by default?
Early data can be replayed, so enabling it needs application level handling.
Sources
Last reviewed: 19 October 2026.
