Hosting
SSL Configuration Tips
A checklist for hardening your TLS configuration.
Protocols
- Disable TLS 1.0 and 1.1; keep TLS 1.2 and 1.3.
- Prefer TLS 1.3; it removes legacy ciphers and speeds up handshakes.
- Turn off SSLv2/SSLv3 entirely.
Ciphers
- Use AEAD suites (AES-GCM, ChaCha20-Poly1305).
- Disable RC4, 3DES, export and NULL ciphers.
- Set ssl_prefer_server_ciphers off on modern nginx so clients pick.
Certificates
- Serve the full chain, including intermediates.
- Renew before expiry — automate with ACME.
- Add CAA records to restrict who may issue for your domain.
Headers
- Enable HSTS with a long max-age, then consider preload.
- Use OCSP stapling to speed up revocation checks.
Calculated in your browser. Free, nothing is uploaded.
About this tool
Free ssl configuration tips tool. A checklist for hardening your TLS configuration. No signup, nothing uploaded.
Frequently asked questions
Are the numbers accurate?
They are standard industry estimates; your provider's list price may differ.
Do you need my server details?
No. Enter the numbers you want to model.
Is anything sent to a server?
No. All maths is local.
Need more than a tool?
HostingSwift runs the servers too — VPS, web hosting, email, DNS and streaming, with a free tier to start.