Turn off TLS 1.0 and 1.1 on Apache

Why it matters

TLS 1.0 and 1.1 are deprecated and no current browser uses them, but leaving them on lets attackers and old tools negotiate weaker encryption. Turning them off costs almost nothing today.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find every existing setting with the grep command below. A VirtualHost or included file that sets SSLProtocol overrides the global line, so change each one (on Debian and Ubuntu the global line is in /etc/apache2/mods-available/ssl.conf, on RHEL-family systems in /etc/httpd/conf.d/ssl.conf).
2. TLS 1.3 needs Apache 2.4.36 or later built with OpenSSL 1.1.1 or later. This form works with older versions too, because it only removes the old protocols.
3. Run apachectl configtest, then reload.

# find existing settings
#   grep -Rn -E 'SSLProtocol|SSLCipherSuite' /etc/apache2 /etc/httpd /etc/letsencrypt
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Enable TLS 1.2 and TLS 1.3
• Enable TLS 1.3