SSL/TLS Configuration: 7 Common Mistakes and How to Fix Them

TLS (Transport Layer Security) is the foundation of secure web communication. Getting it right means your users' data is protected in transit. Getting it wrong can expose encrypted traffic to downgrade attacks, man-in-the-middle interception, and compliance failures. Here are the seven most common TLS mistakes and exactly how to fix them.

Mistake 1: Supporting TLS 1.0 and 1.1

TLS 1.0 (released 1999) and TLS 1.1 (2006) are formally deprecated by the IETF (RFC 8996) and are no longer considered secure. They are vulnerable to attacks like POODLE and BEAST. All major browsers have removed support for these versions.

Fix (Nginx):

ssl_protocols TLSv1.2 TLSv1.3;

Fix (Apache):

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Mistake 2: Using Weak Cipher Suites

Cipher suites that use RC4, DES, 3DES, or export-grade encryption (EXPORT ciphers) are cryptographically broken. Cipher suites without forward secrecy (non-ECDHE/DHE key exchange) mean that if the server's private key is ever compromised, all past recorded traffic can be decrypted.

Fix (Nginx) — modern, forward-secret ciphers only:

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Mistake 3: No HTTPS Redirect

If your server responds to plain HTTP on port 80 without redirecting to HTTPS, users who type your domain without "https://" (or click an old HTTP link) will connect insecurely. Any data sent in that first HTTP request — including cookies — is transmitted in plaintext.

Fix (Nginx):

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Mistake 4: Missing HSTS Header

Even with an HTTP-to-HTTPS redirect in place, a user's very first request can still be intercepted (before the redirect). HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your domain — the browser itself enforces HTTPS without ever making an HTTP request after the first visit.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

See the full guide in our HSTS article.

Mistake 5: Expired or Self-Signed Certificates

An expired certificate causes browser warnings that erode user trust and are technically a TLS failure. Self-signed certificates provide encryption but no identity verification — users have no assurance they are talking to the real server.

Fix: Use certificates from a trusted CA. Let's Encrypt provides free, automatically renewable certificates. Set up automatic renewal with certbot renew in a cron job or use a service like AWS Certificate Manager that handles renewal automatically.

Mistake 6: Server Version Disclosure in Headers

Responding with Server: Apache/2.4.51 (Ubuntu) or X-Powered-By: PHP/7.4.3 gives attackers an exact version number to search for known CVEs. This is low-hanging fruit in any security audit.

Fix (Nginx):

server_tokens off;

Fix (Apache):

ServerTokens Prod
ServerSignature Off

Mistake 7: Failing to Test After Configuration Changes

A misconfiguration can silently break TLS or leave weak protocols re-enabled after a server update. Test your TLS configuration after every change and periodically.

Tools:

• SSL Labs Server Test — comprehensive A-F grading
• openssl s_client -connect example.com:443 — quick command-line check
• Shieldome — automated TLS/SSL checks as part of a full vulnerability scan

TLS Checklist

• TLS 1.2 minimum, TLS 1.3 preferred
• No RC4, DES, 3DES, or export ciphers
• Forward secrecy enabled (ECDHE key exchange)
• HTTP → HTTPS redirect on port 80
• HSTS header with at least 1-year max-age
• Valid, non-expired certificate from trusted CA
• Server version tokens suppressed
• Certificate chain complete (intermediate certs included)

Getting these right earns an A+ on SSL Labs and significantly raises the bar for any attacker targeting your transport layer.