Enable TLS 1.3 on Apache

Why it matters

TLS 1.3 is faster to connect and removes older, weaker options, and every current browser supports it. Your server only offers TLS 1.2, which is safe today but below the common modern baseline.

The fix

1. TLS 1.3 needs Apache 2.4.36 or later with OpenSSL 1.1.1 or later. Update both if older.
2. Find every existing setting with grep -Rn -E 'SSLProtocol|SSLCipherSuite' /etc/apache2 /etc/httpd /etc/letsencrypt. A VirtualHost or included line overrides the global one, so edit each SSLProtocol line (on RHEL-family systems the global line is in /etc/httpd/conf.d/ssl.conf).
3. Run apachectl configtest, then reload.

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Turn off TLS 1.0 and 1.1
• Enable TLS 1.2 and TLS 1.3