Update TLS versions and ciphers

HTTPS is only as strong as the TLS protocol versions and cipher suites your server will negotiate. Old protocols (SSL 3, TLS 1.0, TLS 1.1) and weak ciphers are broken and should be off. The good news: OrbixPanel already ships a safe default — this page shows you what it is, how to check it, and how to tighten it if you want a top grade.

What OrbixPanel uses by default

Every HTTPS site OrbixPanel serves includes the Let’s Encrypt / Mozilla intermediate TLS profile:

include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

That profile enables TLS 1.2 and TLS 1.3 only (TLS 1.0/1.1 and SSLv3 are disabled) with a modern cipher list, and it’s kept up to date by certbot. For most sites this is exactly right: broad client compatibility, no known-broken protocols. Deployed sites also send an HSTS header so browsers refuse to downgrade to plain HTTP.

Test what you’re actually serving

Don’t guess — measure. From another machine:

# Which protocols does the server offer?
nmap --script ssl-enum-ciphers -p 443 yourdomain.com

# Or test one protocol directly (should FAIL for 1.0/1.1):
openssl s_client -connect yourdomain.com:443 -tls1_1 </dev/null

Or use the online SSL Labs test (ssllabs.com/ssltest) for a full A–F grade and a per-client compatibility report. Aim for A or A+.

Tighten to “modern” (TLS 1.3 only) — optional

If every client that reaches your site is current (no old Android/IE), you can go TLS 1.3-only for the strongest posture. Don’t edit options-ssl-nginx.conf directly — certbot overwrites it on upgrade. Instead add an override in the site’s server block (or a snippet you include):

ssl_protocols TLSv1.3;

Then test and reload:

sudo nginx -t && sudo systemctl reload nginx

Trade-off: TLS 1.3-only locks out older clients. If you serve a general audience, keep the default (1.2 + 1.3). Only go 1.3-only for APIs or internal tools with known-modern clients.

HSTS

OrbixPanel adds Strict-Transport-Security to HTTPS sites so browsers remember to use HTTPS and won’t downgrade. If you want it on the browser preload list (a lasting, hard-to-undo commitment that covers all subdomains), submit your domain at hstspreload.org once you’re confident every subdomain is HTTPS-only.

Don’t break renewals

Keep your changes in a separate snippet or the server block, never inside certbot’s options-ssl-nginx.conf.
After any TLS change, run sudo nginx -t before reloading — a broken nginx config can block certificate renewal too.
If a renewal ever fails after a change, see Fix common SSL / HTTPS errors.