How to disable TLS 1.0 and 1.1
Old TLS versions have known weaknesses and browsers refuse them. Allow TLS 1.2 and 1.3 only.
Step by step, with screenshots: TLS 1.2 vs 1.3: what changed, and turning TLS 1.0 and 1.1 off →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free SSL checker or the free HTTP/2 & HTTP/3 test.
What it is
TLS (Transport Layer Security) is the protocol that encrypts HTTPS connections. Versions 1.0, from 1999, and 1.1, from 2006, are obsolete; current servers should accept only TLS 1.2 and TLS 1.3.
The IETF formally deprecated TLS 1.0 and 1.1 in RFC 8996 in March 2021, and Chrome, Edge, Firefox and Safari stopped using them in 2020. PCI DSS has not allowed them for card payments since June 2018. getReport attempts a TLS 1.0 or 1.1 handshake and fails the check if your server accepts it. Your server is OK when it negotiates TLS 1.3 with modern browsers and refuses anything older than 1.2.
What a passing site looks like
- The server only accepts TLS 1.2 or newerfail · −10 ptseffort M
The server still accepts TLS 1.0 or 1.1
Why it matters. TLS 1.0 and 1.1 have known weaknesses and every major browser dropped them in 2020. A server that still accepts them lets an attacker downgrade a connection to one they can break.
- Set the minimum protocol to TLS 1.2 (nginx: ssl_protocols TLSv1.2 TLSv1.3; Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3).
- Behind Cloudflare or another CDN, set "Minimum TLS Version" to 1.2 in its dashboard.
Questions people ask
What is wrong with TLS 1.0?
TLS 1.0 relies on weak building blocks, such as MD5 and SHA-1 in its handshake and an older way of using CBC ciphers, and it has known attacks such as BEAST. Keeping it enabled lets an attacker try to push a connection down to the weakest version both sides accept. No current browser needs it, so turning it off costs you nothing with real visitors.
Are TLS 1.0 and 1.1 deprecated?
Yes. RFC 8996, published in March 2021, formally deprecates both and says they must not be used. All major browsers removed support in 2020, and PCI DSS has required TLS 1.2 or newer for card payments since June 2018. Security scanners and compliance audits flag any server that still accepts the old versions.
How do I disable TLS 1.0 and 1.1?
Set the allowed protocols in your web server or CDN. In nginx, use ssl_protocols TLSv1.2 TLSv1.3; in Apache, SSLProtocol -all +TLSv1.2 +TLSv1.3; on Cloudflare, set Minimum TLS Version to 1.2. On Windows Server, disable the old protocols in the SChannel registry settings. Reload the server and run a new report to confirm the old versions are refused.
When did TLS 1.0 reach end of life?
Browsers dropped TLS 1.0 and 1.1 in 2020: Chrome and Edge in version 84, Firefox in version 78, and Safari with iOS 14 and macOS Big Sur. The IETF made the deprecation official in March 2021 with RFC 8996. There is no support date left to wait for: a device limited to TLS 1.0 is too old to use most of the web.