This question is about setting the correct value of ssl_prefer_server_ciphers while configuring nginx.

According to a fairly typical config suggested by Mozilla, the value should be off (source: https://ssl-config.mozilla.org/#server=nginx&server-version=1.17.7&config=intermediate&openssl-version=1.0.1g).

According to nginx's own documentation, one should always set this to on: https://www.nginx.com/blog/nginx-https-101-ssl-basics-getting-started/ (search the document for ssl_prefer_server_ciphers).

I'm stumped as to which advice to follow. Both sources are pretty solid.

Can some industry experts chime in regarding when one should turn this off, and when on? Would also love to know the rationale.

2 Answers 2


Ok, so there are three categories for choosing this parameter on or off.

**Modern** : Services with clients that support TLS 1.3 and don't need backward compatibility
**Intermediate** : General-purpose servers with a variety of clients, recommended for almost all systems
**Old** : Compatible with a number of very old clients, and should be used only as a last resort

Only situation when you need to put off this parameter is modern configuration where you don't need any backward compatibility, in such cases client will not be able to connect with old ssl/tls except tlsv1.3.

  • 8
    Except that Mozilla recommend it as off even for intermediate configuration ssl-config.mozilla.org Commented May 13, 2020 at 6:58
  • 3
    This does not answer the question.
    – marcelm
    Commented Oct 24, 2023 at 19:51

When ssl_prefer_server_ciphers is set to on, the web server owner can control which ciphers are available.

The reason why this control was preferred is old and insecure ciphers that were available in SSL, and TLS v1.0 and TLS v1.1.

When the server supports old TLS versions and ssl_prefer_server_ciphers is off, an adversary can interfere with the handshake and force the connection to use weak ciphers, therefore allowing decrypting of the connection.

The weak ciphersuites have been deprecated in TLS v1.2 and v1.3, which removes the need for server to specify preferred ciphers.

The preferred setting in modern setups is ssl_prefer_server_ciphers off, because then the client device can choose his preferred encryption method based on the hardware capabilities of the client device.

For example, if the mobile device does not have AES acceleration, it can choose to use ChaCha cipher for better performance.

  • 1
    Adding onto what Tero mentioned above. Here is a Mozilla page that gives some further explanation in regards to the ssl config generator you linked in the question: wiki.mozilla.org/Security/Server_Side_TLS
    – Cory Lewis
    Commented Aug 19, 2020 at 19:10
  • To further tweak your SSL config, see also the Mozilla SSL Configuration Generator: ssl-config.mozilla.org
    – Juraj
    Commented Jan 17, 2022 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .