Skip to content

How to disable TLS 1.0 and 1.1

Security1 min readFixes check tls-version-min-1-2

Old TLS versions have known weaknesses and browsers refuse them. Allow TLS 1.2 and 1.3 only.

Step by step, with screenshots: Caddy: the two-line https server and the headers to add to it →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • The server only accepts TLS 1.2 or newerfail · −10 ptseffort M

The server still accepts TLS 1.0 or 1.1

Why it matters. TLS 1.0 and 1.1 have known weaknesses and every major browser dropped them in 2020. A server that still accepts them lets an attacker downgrade a connection to one they can break.

How to fix it.
  1. Set the minimum protocol to TLS 1.2 (nginx: ssl_protocols TLSv1.2 TLSv1.3; Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3).
  2. Behind Cloudflare or another CDN, set "Minimum TLS Version" to 1.2 in its dashboard.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.