How to Fix Weak SSL/TLS Configuration in Laravel
Your SSL/TLS certificate is expired, misconfigured, or using weak protocols. Learn how to fix SSL issues for your Laravel app.
The history of SSL/TLS is one of repeated cryptographic breaks. SSLv2 was cracked in 1995. SSLv3 fell to the POODLE attack in 2014. TLS 1.0 was shown vulnerable to the BEAST attack in 2011 and POODLE for TLS in 2014. TLS 1.1 was formally deprecated by the IETF in 2020. Each protocol version contained fundamental weaknesses that allowed attackers to intercept and decrypt encrypted traffic in certain scenarios. TLS 1.2 (2008) addressed most of these issues, and TLS 1.3 (2018) provides the strongest security and best performance available today.
The practical attack against weak TLS is typically an SSL downgrade: an attacker positioned between the client and server — on the same network, or through DNS manipulation — forces the connection to negotiate the oldest supported protocol, then exploits that protocol's weakness to decrypt traffic. For applications still supporting TLS 1.0, POODLE attacks are viable on any network path the attacker can influence. HSTS (HTTP Strict Transport Security) partially mitigates this by instructing browsers to always use HTTPS, but it only works after the browser has previously visited the site and cached the policy.
Expired certificates create a separate and immediate problem: browsers display scary security warnings that destroy user trust instantly. For e-commerce and SaaS applications, a certificate expiry event typically causes an immediate traffic drop and customer support calls within minutes. Let's Encrypt's 90-day certificates with automated renewal via certbot largely solved the expiry problem, but manual certificate management and missing renewal monitoring remain common failure points. StackShield monitors your certificate expiration and protocol configuration continuously so you know before your users do.
The Problem
Weak SSL/TLS configuration means your application may be using expired certificates, outdated protocols (TLS 1.0/1.1), or weak cipher suites that can be broken by attackers. This exposes all data transmitted between your users and your application to interception, including login credentials, personal data, and session tokens. Browsers will show security warnings that drive users away.
How to Fix
-
1
Install or renew your SSL certificate
Use Let's Encrypt for free, auto-renewing certificates. Install Certbot:
sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d yourdomain.com -d www.yourdomain.comCertbot will automatically configure Nginx and set up auto-renewal. Verify renewal works:
sudo certbot renew --dry-run -
2
Disable outdated TLS protocols
In Nginx, only allow TLS 1.2 and 1.3:
ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off;In Apache:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 -
3
Force HTTPS in Laravel
Ensure Laravel generates HTTPS URLs and redirects HTTP traffic. In app/Providers/AppServiceProvider.php:
public function boot(): void { if (config('app.env') === 'production') { \Illuminate\Support\Facades\URL::forceScheme('https'); } }Add the HSTS header in your security headers middleware:
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains'); -
4
Redirect all HTTP traffic to HTTPS
In Nginx, add a server block that redirects HTTP:
server { listen 80; server_name yourdomain.com www.yourdomain.com; return 301 https://$server_name$request_uri; }In Apache .htaccess:RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
How to Verify
Test your SSL configuration using SSL Labs:
https://www.ssllabs.com/ssltest/analyze.html?d=yourdomain.com
Aim for an A or A+ grade. Also verify from the command line:
openssl s_client -connect yourdomain.com:443 -tls1_1This should fail (connection refused), confirming TLS 1.1 is disabled.
Prevention
Use auto-renewing certificates from Let's Encrypt with Certbot. Set up monitoring for certificate expiration at least 14 days before expiry. Use StackShield to continuously monitor your SSL certificate status, expiration date, and protocol configuration.
Frequently Asked Questions
Do I need a paid SSL certificate?
No. Let's Encrypt provides free SSL certificates that are trusted by all major browsers. Paid certificates (EV/OV) show organization details in the certificate but provide no additional encryption benefit. For most Laravel applications, Let's Encrypt is the right choice.
Will disabling TLS 1.0/1.1 break anything?
TLS 1.0 and 1.1 were deprecated in 2020. All modern browsers support TLS 1.2+. The only clients affected would be Internet Explorer on Windows XP or very old Android devices (pre-5.0), which represent a negligible percentage of traffic.
How do I handle SSL with a load balancer?
When using a load balancer (AWS ALB, Cloudflare, etc.), SSL terminates at the load balancer. Set APP_URL to https:// in your .env and configure the TrustedProxy middleware to trust the load balancer IP. Laravel will then correctly detect HTTPS from the X-Forwarded-Proto header.
What is HSTS preloading and should I use it?
HSTS preloading submits your domain to a browser-maintained list that forces HTTPS even on the very first visit, before the HSTS header has been cached. To qualify, you need max-age of at least 31536000, includeSubDomains, and the preload directive. Submit at hstspreload.org. This is a strong security improvement but is difficult to reverse — ensure all your subdomains support HTTPS before enabling it.
How do I fix mixed content warnings after enabling HTTPS?
Mixed content warnings appear when an HTTPS page loads resources (images, scripts, stylesheets) over HTTP. In Laravel, ensure APP_URL starts with https:// and call URL::forceScheme('https') in AppServiceProvider. For existing content, use the Content-Security-Policy: upgrade-insecure-requests directive, which tells browsers to automatically upgrade HTTP sub-resource requests to HTTPS.
Related Security Terms
Related Guides
How to Fix Missing Security Headers in Laravel
Your Laravel app is missing critical security headers like CSP, HSTS, and X-Frame-Options. Learn how to add them with middleware.
Laravel Session Security: Fix Insecure Cookie Config (Secure, HttpOnly, SameSite)
Laravel session cookies missing Secure, HttpOnly, or SameSite flags? Fix your config/session.php to prevent session hijacking, cookie theft, and CSRF attacks.
How to Fix DNS Security Issues and Misconfigurations
DNS misconfigurations like open zone transfers and missing DNSSEC expose your domain to hijacking and spoofing attacks. Fix them now.
Is your Laravel app exposed right now?
34% of Laravel apps we scan have at least one critical issue. Most teams don't find out until something breaks. Our free scan checks your live application in under 60 seconds.