TLS 1.0 (1999) and TLS 1.1 (2006) were formally deprecated in 2021 (RFC 8996), and every major browser has removed them. A server that still accepts them gains nothing and keeps weak options available to attackers. TLS 1.3 is faster (one round trip to connect) and removes old, risky features.
Goal: allow TLS 1.2 and TLS 1.3 only.
Check what your server accepts now
Run the SSL checker: it tests each TLS version and lists which are accepted. A server that still accepts TLS 1.0 or 1.1 gets grade B; fixing that (with everything else right) gives an A.
With openssl, try each version (a successful connection prints the certificate and Protocol : TLSv1.x; a refused one prints an error):
openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null
Recent OpenSSL versions can't offer TLS 1.0/1.1 by default, so a local failure for -tls1_1 doesn't always prove the server refuses it; the online checker tests that properly.
Nginx
In each server block on port 443 (or once in the http block):
ssl_protocols TLSv1.2 TLSv1.3;
TLS 1.3 needs Nginx 1.13+ built with OpenSSL 1.1.1+, which any current distribution has. Then:
sudo nginx -t && sudo systemctl reload nginx
Apache
In the HTTPS virtual host, or globally in the mod_ssl configuration (ssl.conf):
SSLProtocol -all +TLSv1.2 +TLSv1.3
TLS 1.3 needs Apache 2.4.36+ with OpenSSL 1.1.1+. Then:
sudo apachectl configtest && sudo systemctl reload apache2 # httpd on RHEL
IIS / Windows Server
IIS uses Windows' TLS stack (SChannel), so this is a Windows setting:
- Windows Server 2022 and later support TLS 1.3 and have it on by default.
- Windows Server 2016/2019 support up to TLS 1.2.
To turn off TLS 1.0 and 1.1, use the free IIS Crypto tool (Nartac Software): choose the Best Practices template, apply and restart the server. Or set the registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server (and TLS 1.1\Server): Enabled = 0 and DisabledByDefault = 1 (DWORD), then restart.
Test before production: very old clients (Windows 7 without updates, old Java or embedded devices) may only speak TLS 1.0.
Choose ciphers, too
Protocol versions are half the story; the cipher list matters as well. The Mozilla SSL Configuration Generator produces a ready-made Nginx, Apache or HAProxy configuration for your exact versions. Its Intermediate profile allows TLS 1.2 and 1.3 with modern ciphers and suits nearly every public website.
Behind a CDN or load balancer
If visitors connect to a CDN or cloud load balancer, its settings decide which versions visitors can use:
- Cloudflare: SSL/TLS → Edge Certificates → Minimum TLS Version → TLS 1.2.
- AWS Application Load Balancer: choose a TLS security policy that allows only TLS 1.2 and 1.3 on the HTTPS listener.
The server behind it still deserves the same settings for the CDN-to-origin connection (Cloudflare SSL modes).
Confirm
Run the SSL checker again: TLS 1.0 and 1.1 should show Refused, TLS 1.2 and 1.3 Accepted.
CertHalo re-checks your TLS setup on every scheduled check, so a configuration change that brings back an old protocol shows up in your grade. Monitor 3 certificates free.