Articles

TLS 1.0/1.1: The End is Here

March 15, 2026 5 min read

TLS 1.0 is still in use because it’s the default for many older systems, and the process of upgrading can be complex and time-consuming.

Here’s how to check for and disable TLS 1.0, and then migrate to TLS 1.3.

Checking for TLS 1.0 Usage

Before disabling, you need to know if it’s being used and where.

1. Web Server Logs:

Most web servers log the TLS version used for each connection.

  • Apache: Look for the SSLProtocol directive in your ssl.conf or virtual host configuration. If it’s not explicitly set or is set to include TLSv1, you’re likely using it. You can also parse access logs. The %{SSL_PROTOCOL}x log format variable can show the protocol.
    • Diagnosis: grep "TLSv1" /var/log/apache2/access.log (adjust log path as needed).
    • Fix: In your Apache SSL configuration file (e.g., /etc/apache2/mods-available/ssl.conf or within a <VirtualHost> block):
      SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5:!RC4
SSLHonorCipherOrder on
      • Why it works: This explicitly disables SSLv3, TLSv1, and TLSv1.1, forcing Apache to use TLS 1.2 and TLS 1.3 (if supported by the client). SSLHonorCipherOrder on ensures the server’s preferred cipher order is used, which is more secure.
  • Nginx: Check your nginx.conf or site-specific configuration for the ssl_protocols directive.
    • Diagnosis: grep "ssl_protocols" /etc/nginx/nginx.conf (and any included files).
    • Fix: In your Nginx configuration file (e.g., /etc/nginx/nginx.conf or within a server block):
      ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;
      • Why it works: This directive explicitly lists the allowed TLS protocols, excluding older, less secure versions. The ssl_ciphers and ssl_prefer_server_ciphers directives ensure strong, modern cipher suites are prioritized.
  • IIS: Use IIS Manager. Navigate to your site -> Bindings -> Edit -> Select your HTTPS binding -> View. The "Enable TLS 1.0" checkbox (and similar for 1.1) needs to be unchecked.
    • Diagnosis: Open IIS Manager, select your website, click "Bindings" in the Actions pane, select the HTTPS binding, and click "Edit".
    • Fix: Uncheck the "Enable TLS 1.0" and "Enable TLS 1.1" options. You may need to do this at the server level (Server -> Server Name -> SSL Settings) if you want to disable it globally.
      • Why it works: IIS GUI directly controls registry settings that enable/disable specific TLS protocol versions for the server. Unchecking these boxes modifies those registry keys.

2. Network Scanners:

Tools like SSL Labs’ SSL Server Test (for public-facing sites) or nmap can probe your server for supported protocols.

  • SSL Labs Test: Go to https://www.ssllabs.com/ssltest/ and enter your domain name. It will provide a comprehensive report including supported TLS versions.
  • Nmap (for internal/specific IPs):
    • Diagnosis: nmap --script ssl-enum-ciphers -p 443 your.server.ip.address
    • Fix: This tool diagnoses. The fix is to adjust your web server configuration as described above and then restart the service.
    • Why it works: Nmap’s ssl-enum-ciphers script attempts to connect to the specified port using various TLS versions and reports which ones are successful.

3. Client-Side Checks:

If you have control over clients, you can check their browser or application settings.

  • Browsers: Modern browsers (Chrome, Firefox, Edge, Safari) have disabled TLS 1.0 and 1.1 by default for years. If you’re seeing issues with older clients, it might be their browser.
    • Chrome: chrome://settings/security -> Advanced -> "Use TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3" (ensure TLS 1.0/1.1 are not checked if you want to disable them on the client).
    • Firefox: about:config -> search for security.tls.version.min and security.tls.version.max. Set min to 3 (TLS 1.2) and max to 4 (TLS 1.3).
  • Java: Older Java versions might default to or require TLS 1.0. Check your Java runtime environment (JRE) java.security file (e.g., $JAVA_HOME/jre/lib/security/java.security). Look for jdk.tls.disabledAlgorithms.
    • Diagnosis: Examine $JAVA_HOME/jre/lib/security/java.security for disabledAlgorithms.
    • Fix: Add TLSv1, TLSv1.1 to the jdk.tls.disabledAlgorithms line. For example:
      jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224
      • Why it works: This property directly tells the Java Secure Socket Extension (JSSE) which algorithms and protocols are forbidden.
  • Other Applications: Applications that use specific libraries (like OpenSSL, GnuTLS) for TLS might have their own configuration files or command-line flags to control protocol versions.

Common Causes of TLS 1.0 Usage

  1. Default Configurations: Many server software packages (Apache, Nginx) and operating systems have historically included TLS 1.0 in their default secure protocol lists.
  2. Legacy Client Support: The primary reason TLS 1.0 persists is to support very old clients (browsers, operating systems, custom applications) that cannot negotiate newer TLS versions.
  3. Misconfigured Load Balancers/Proxies: Intermediate network devices might be configured to accept or forward older TLS versions, even if the backend servers support only newer ones.
  4. Application Hardcoding: Some applications might have TLS 1.0 "hardcoded" into their client or server components, requiring code changes to update.
  5. Lack of Awareness/Maintenance: IT teams may not be aware that TLS 1.0 is still enabled or may not prioritize updating configurations as part of regular maintenance.
  6. Specific Hardware/Appliance Limitations: Older network appliances, embedded systems, or specialized hardware might only support TLS 1.0 or 1.1 and cannot be easily upgraded.

Migrating to TLS 1.3

The goal is to enable TLS 1.2 and TLS 1.3 exclusively.

1. Update Server Software: Ensure your web server (Apache, Nginx), load balancer, and any other TLS-terminating components are running recent versions that fully support TLS 1.3.

  • Apache: Version 2.4.36+ is recommended for full TLS 1.3 support via OpenSSL 1.1.1+.
  • Nginx: Version 1.13.0+ requires OpenSSL 1.1.1+ for TLS 1.3 support.
  • OpenSSL: Version 1.1.1 or later is mandatory for TLS 1.3 support.

2. Configure Protocols: As shown in the "Checking" section, explicitly define the allowed protocols.

  • Apache: SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
  • Nginx: ssl_protocols TLSv1.2 TLSv1.3;

3. Choose Strong Ciphers: TLS 1.3 simplifies cipher suites significantly, removing many older, weaker ones. Focus on enabling modern, robust cipher suites for TLS 1.2 compatibility.

  • Apache:
    SSLCipherSuite HIGH:!aNULL:!MD5:!RC4:!TLSv1:!TLSv1.1
SSLProxyCipherSuite HIGH:!aNULL:!MD5:!RC4:!TLSv1:!TLSv1.1
  • Nginx:
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

4. Test Thoroughly: After making changes, restart your services and immediately test using the methods described earlier (SSL Labs, nmap). Pay close attention to any legacy clients or applications that might have previously connected.

5. Monitor for Issues: Keep an eye on server logs and error reporting for any new connection failures that might indicate a client unable to support TLS 1.2/1.3.

6. Graceful Deprecation: If you encounter critical legacy systems, consider solutions like: * Reverse Proxy: Place a modern reverse proxy (e.g., Nginx, HAProxy) in front of the legacy system. The proxy handles TLS 1.3 with clients and can negotiate TLS 1.0/1.1 with the backend if absolutely necessary (though this is a temporary measure). * Application Updates: Prioritize updating or replacing the legacy applications/clients.

The Next Step

After disabling TLS 1.0 and migrating to TLS 1.3, the next common challenge is managing certificate expirations and ensuring you have strong, up-to-date certificate chains.

Related Concepts

More Deep Dives in Tls Ssl

Want structured learning?

Take the full Tls-ssl course →