Disable TLS 1.0 and TLS 1.1 in Apache

Set Apache's SSLProtocol to explicitly allow the TLS versions you intend to serve, then validate and reload the configuration. On a build that supports TLS 1.3:

SSLProtocol -all +TLSv1.2 +TLSv1.3

TLS 1.0 and 1.1 are obsolete. Before removing them from a legacy service, identify affected clients and plan their upgrade; a protocol change can interrupt clients that cannot negotiate a permitted version.

Find the active SSL configuration

Common locations include:

• Debian/Ubuntu: /etc/apache2/mods-available/ssl.conf and enabled SSL virtual hosts, such as default-ssl.conf.
• RHEL-family systems: /etc/httpd/conf.d/ssl.conf and included virtual-host files.

Inspect the configuration actually loaded by your installation. A setting in an inactive file has no effect, and another virtual host may have a different policy.

Choose an explicit protocol policy

The allowlist above is clearer than subtracting older protocols from all. A subtractive configuration can look like this:

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Its result depends on the protocols supported by the build and is not a timeless equivalent of an explicit TLS 1.2/1.3 allowlist. Avoid copying an obsolete SSLv2 token into a build that does not recognize it.

TLS 1.3 requires compatible Apache/mod_ssl and OpenSSL support; OpenSSL 1.1.1 introduced that protocol. If the installed build cannot support it, allow TLS 1.2 while upgrading the stack rather than enabling obsolete versions.

Cipher configuration is a separate decision. The following example excludes several weak choices for TLS 1.2 and earlier, but it is not a complete security baseline:

SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLHonorCipherOrder on

Review the suites against the deployed OpenSSL version and your organization's policy. TLS 1.3 cipher configuration is separate. See Apache's mod_ssl reference.

Validate and reload

# Debian / Ubuntu
sudo apachectl configtest && sudo systemctl reload apache2

# RHEL-family systems
sudo apachectl configtest && sudo systemctl reload httpd

A successful configuration test does not establish that every endpoint uses the intended protocol policy. Test fresh connections after reload.

Verify both rejection and acceptance

# Old versions should not complete a handshake.
openssl s_client -connect example.com:443 -servername example.com -tls1 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/null

# Permitted versions should negotiate successfully on a supporting build.
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null

Read the negotiated protocol and handshake diagnostics. A modern test client's refusal to offer an old protocol, a local cipher-policy error, or a TCP connection failure does not prove the server disabled that protocol. Use a suitable authorized protocol scanner or SSL Labs for an independent check of a public endpoint.

Compare server TLS errors with known client tests after the change. Guance DataKit log collection can bring those logs together across instances; a failed handshake alone does not identify the client's exact version.

Common questions

Can virtual hosts use different protocol policies?

Apache 2.4.42 and later, linked against OpenSSL 1.1.1 or later, can honor a name-based virtual host's SSLProtocol when the client sends SNI. Older combinations use the base virtual host's policy for protocol negotiation. Check the default host and test every intended name.

Which clients might stop working?

Old browsers, Java runtimes, Android versions, and embedded devices may lack usable TLS 1.2 support or have it disabled. Compatibility depends on version, patch level, and configuration; a blanket version cutoff is unreliable.

What if the site stops responding after the change?

Check configuration syntax, the active service's error log, and a known modern client. Distinguish an invalid server configuration from the expected rejection of an obsolete client.

For Nginx, the corresponding protocol setting is ssl_protocols TLSv1.2 TLSv1.3;.