SSL Toolkit Logo
Tools Features Compare FAQ Login
Ng

PEM/PFX to Nginx Config

Convert your SSL certificate to a production-ready Nginx server block configuration.

About

This tool converts your SSL certificate (PEM format or PFX/PKCS12) into a production-ready Nginx server block configuration. It follows the Mozilla Server Side TLS guidelines — the same standards used by SSL Labs to grade servers.

The generated config includes SSL protocols, cipher suites, session settings, OCSP stapling, HSTS headers, and HTTP to HTTPS redirect. Simply paste your certificate or upload a PFX file, select a security profile, and get a copy-paste ready Nginx config.

How to Use

  1. 1Upload your PEM certificate file or paste the data. You can also upload a PFX/PKCS12 file.
  2. 2If using PFX, enter the password in the PFX Password field.
  3. 3Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  4. 4Toggle features: HSTS, OCSP Stapling, HTTP to HTTPS redirect, HTTP/2.
  5. 5Click Generate Nginx Config and copy or download the configuration.

Use Cases

✓New Nginx server — Generate SSL config when deploying a new Nginx server.
✓Certificate renewal — Update Nginx config after renewing your SSL certificate.
✓SSL Labs A+ — Generate configs that earn an A+ grade on SSL Labs.
✓HSTS preload — Get Nginx config with HSTS headers ready for preload submission.
✓PFX migration — Convert PFX certificate from IIS/Windows to Nginx format.
✓Security hardening — Apply Mozilla recommended cipher suites to Nginx.

Tips & Best Practices

  • •Use the Intermediate profile for most sites. Only use Modern if all clients support TLS 1.3.
  • •Enable OCSP stapling — Nginx fetches the OCSP response periodically, faster handshakes for clients.
  • •Use ssl_trusted_certificate for OCSP stapling verification.
  • •Reload Nginx after config changes: nginx -s reload
  • •Test config before reload: nginx -t
  • •Place cert and key in /etc/nginx/ssl/ with restrictive permissions.

Nginx SSL Directives Explained

ssl_certificate / ssl_certificate_key

Path to the fullchain certificate and private key files. Use absolute paths.

ssl_protocols

Specifies allowed TLS versions. Modern: TLSv1.3. Intermediate: TLSv1.2 TLSv1.3.

ssl_ciphers

Cipher suites allowed for handshake. Leave empty for TLS 1.3 (auto-negotiated).

ssl_stapling / ssl_stapling_verify

Enables OCSP stapling. Server fetches and caches the OCSP response for faster handshakes.

Frequently Asked Questions

What files do I need for Nginx SSL?

Nginx requires two files: the fullchain certificate (ssl_certificate) and the private key (ssl_certificate_key). Download the -fullchain.pem and .key files from this tool.

How do I enable OCSP stapling in Nginx?

Add ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /path/to/chain.pem; to your server block. The chain certificate is required for verification.

How do I reload Nginx after changing SSL config?

Run nginx -t to test the config, then nginx -s reload to apply changes without downtime.

Related Tools

All Servers

Configs for all 6 servers
Ap

PEM to Apache

Apache VirtualHost config
HA

PEM to HAProxy

HAProxy frontend config

SSL Checker

Verify your Nginx config

SSL Converter

Convert cert formats

Cipher Ranking

Rank cipher suites