• HTTPS only: Reject or redirect HTTP requests. Return HTTP 301 to the HTTPS version, or return HTTP 400 Bad Request for non-HTTPS API calls. Set HSTS to enforce this at the browser level (MIT 03).

• TLS version: Disable TLS 1.0 and TLS 1.1. These versions have known vulnerabilities (POODLE, BEAST, CRIME) and are deprecated by RFC 8996. Require TLS 1.2 minimum; prefer TLS 1.3.

• Cipher suites: Disable weak cipher suites (RC4, 3DES, NULL ciphers, export-grade ciphers). Use a modern configuration — Mozilla’s SSL Configuration Generator (ssl-config.mozilla.org) provides copy-paste configs for nginx, Apache, and other servers.

• Certificate management: Use Let’s Encrypt (via Certbot) or your cloud provider’s certificate management to automate renewal. An expired certificate makes the API unreachable and is a visible security failure.

Qualys SSL Labs (ssllabs.com/ssltest) provides a free, detailed analysis of your TLS configuration, grading cipher suites, protocol versions, certificate validity, and known vulnerabilities. An “A” grade is the target. Run this check on every public API endpoint and after any TLS configuration change.

Internal APIs between services should also use TLS — the “it’s internal so it’s safe” assumption fails with SSRF, compromised internal hosts, or misconfigured network segments. mTLS (mutual TLS) is the strongest option for service-to-service communication inside a cluster.