TLS 1.0 and 1.1: How to Check Your Server and Disable Them

To check which TLS versions your server supports, try a connection with each version one at a time, using an online checker or openssl s_client. If TLS 1.0 or 1.1 still connects, turn them off in your web server, control panel or CDN settings. Leave TLS 1.2 and 1.3 on, then test again to confirm the old versions are refused.

Our free TLS Version Checker tries TLS 1.3, 1.2, 1.1 and 1.0 against your domain on port 443 and shows which ones the server accepts, along with the cipher it negotiated. This guide covers how to test your server thoroughly (including the places a quick check misses), how to find out whether anyone still connects with old versions, and the exact settings for each common platform.

If you want the background on what TLS 1.3 changed and why it's faster, read TLS 1.3 explained first. This guide is the hands-on part.

Why TLS 1.0 and 1.1 have to go

• They're formally deprecated. RFC 8996, published in March 2021, deprecates both versions and says implementations "MUST NOT" negotiate them.
• Browsers dropped them years ago. Chrome removed TLS 1.0 and 1.1 in Chrome 84 in 2020, and Firefox, Safari and Edge also turned them off in 2020. Real visitors in browsers aren't using them.
• Card payments. The PCI Security Standards Council set 30 June 2018 as the deadline for removing SSL and early TLS from cardholder-data environments. If your site or server is in scope for PCI DSS, old TLS versions will fail a scan.
• Security reviews flag them. Penetration tests, supplier security questionnaires and cyber insurance forms routinely ask about old protocols. The UK NCSC's TLS guidance recommends TLS 1.3, with TLS 1.2 where you still need compatibility.

TLS 1.2 is still secure when it's configured with modern ciphers. Turning it off would lock out some older devices and business software for no real benefit, so the target is TLS 1.2 + TLS 1.3.

Step 1: Check what your server accepts

The quick check

Run your domain through the TLS Version Checker. You'll see one of three things:

• TLS 1.2 and 1.3 only. Nothing to do for this hostname.
• TLS 1.0 and/or 1.1 still enabled. Carry on with this guide.
• TLS 1.3 not supported. Not urgent, but worth enabling while you're changing the configuration.

For a full report including cipher suites, certificate chain and known weaknesses, Qualys SSL Labs is free and thorough, but takes a minute or two per host.

From the command line

openssl s_client lets you force a single protocol version:

# Should succeed
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null

# Should fail after you've finished
openssl s_client -connect example.com:443 -servername example.com -tls1_1 -cipher 'DEFAULT@SECLEVEL=0' </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1 -cipher 'DEFAULT@SECLEVEL=0' </dev/null

A successful handshake prints the certificate chain and a line such as Protocol : TLSv1.2. A refusal ends with a handshake failure or "no protocols available".

One catch: OpenSSL 3.x clients refuse TLS 1.0 and 1.1 at their default security level, so on a modern laptop the old-protocol tests can "fail" even though the server would accept them. That's why the commands above add -cipher 'DEFAULT@SECLEVEL=0', which allows your client to offer the old versions. Some Linux distributions build OpenSSL with old protocols removed entirely. If you can't get a TLS 1.0 handshake to any server at all, use an online checker instead.

Two other good options:

# nmap lists every protocol and cipher the server accepts
nmap --script ssl-enum-ciphers -p 443 example.com

# testssl.sh (free, open source), protocols only
./testssl.sh -p example.com

Places a quick check misses

A single test of https://yourdomain checks one hostname on one port, served by whatever answers first. Also check:

• The origin behind your CDN. If Cloudflare or another CDN is in front of your site, a public test shows the CDN's settings, not your server's. If the origin server can be reached directly by its IP address, it can still accept TLS 1.0. Test it with openssl s_client -connect <origin-ip>:443 -servername example.com.
• Other hostnames. www, shop., portal. and old subdomains may be served by different servers or virtual hosts.
• Mail ports. SMTP (25 and 587 with STARTTLS, 465), IMAP (993) and POP3 (995) have their own TLS settings. Test them with openssl s_client -connect mail.example.com:993 or, for STARTTLS, -starttls smtp -connect mail.example.com:587. Our guide to MTA-STS and TLS-RPT covers enforcing TLS for incoming mail.
• Control panel ports. cPanel/WHM (2083, 2087) and Plesk (8443) run their own services.

Step 2: Find out who still uses TLS 1.0/1.1

Before you switch the old versions off, spend a week logging which protocol each client actually uses. That turns "will this break anything?" from a guess into a list.

Nginx: add $ssl_protocol and $ssl_cipher to a log format:

log_format tls '$remote_addr [$time_local] "$request" $status '
               '$ssl_protocol $ssl_cipher "$http_user_agent"';
access_log /var/log/nginx/tls.log tls;

Apache: use the SSL_PROTOCOL variable:

LogFormat "%h %t \"%r\" %>s %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%{User-Agent}i\"" tls
CustomLog ${APACHE_LOG_DIR}/tls.log tls

Then count them:

awk '{print $(NF-2)}' /var/log/nginx/tls.log | sort | uniq -c

The column number depends on your log format, so adjust $(NF-2) if needed. If TLS 1.0/1.1 connections come from bots, scanners or nothing at all, go ahead. If they come from a payment terminal, stock-control integration, old Android tablet in the warehouse or a partner's API client, contact that owner first.

Typical clients that still use old versions:

• Old .NET Framework applications. Apps built for older .NET versions can default to TLS 1.0 unless they're updated or configured to use the operating system's defaults.
• Very old Android devices (4.x era) and embedded devices such as card readers, printers and building systems.
• Legacy Java or PHP integrations running on unsupported runtimes.

Step 3: Disable TLS 1.0 and 1.1

Back up the configuration file first, change it, test the syntax, then reload.

Nginx

Put this in the http {} block so every server block inherits it:

ssl_protocols TLSv1.2 TLSv1.3;

Since Nginx 1.23.4 the documented default is already TLSv1.2 TLSv1.3, but many servers have an older explicit line (often in nginx.conf or a Certbot include such as options-ssl-nginx.conf) that still lists TLSv1 TLSv1.1. Search for every occurrence:

grep -rn "ssl_protocols" /etc/nginx/
sudo nginx -t && sudo systemctl reload nginx

Set it in the http block rather than separately in each server block. Several sites sharing one IP address and port can otherwise end up with the default server's protocol list.

Apache

In your global SSL configuration (for example ssl.conf, mods-enabled/ssl.conf or options-ssl-apache.conf):

SSLProtocol -all +TLSv1.2 +TLSv1.3

TLS 1.3 needs Apache 2.4.37 or later built against OpenSSL 1.1.1 or later. On older builds, use -all +TLSv1.2. Check for overrides in individual virtual hosts, then reload:

grep -rn "SSLProtocol" /etc/apache2/ /etc/httpd/ 2>/dev/null
sudo apachectl configtest && sudo systemctl reload apache2

cPanel and WHM (VPS or dedicated)

In WHM, go to Service Configuration → Apache Configuration → Global Configuration and set SSL/TLS Protocols to TLSv1.2 (add +TLSv1.3 if your build supports it), then save and rebuild the configuration. Mail services have their own settings: Exim in the Exim Configuration Manager and Dovecot under Mailserver Configuration. Check both, then retest ports 465, 587 and 993.

On shared hosting you can't change these settings yourself. Run the checker and send the result to your host. Most shared hosts already disable the old versions, and those that haven't usually will on request.

IIS on Windows Server

IIS uses the Windows Schannel settings, which are stored in the registry. To disable TLS 1.0 and 1.1 for incoming connections, run this in an elevated PowerShell window:

foreach ($v in 'TLS 1.0','TLS 1.1') {
  $k = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$v\Server"
  New-Item -Path $k -Force | Out-Null
  New-ItemProperty -Path $k -Name 'Enabled' -Value 0 -PropertyType DWord -Force | Out-Null
}

Restart the server so every service picks up the change. Services reuse their existing TLS settings until they restart. Many administrators use the free IIS Crypto tool instead, which sets the same registry keys through a GUI and has a "Best Practices" template. Schannel affects more than IIS. Remote Desktop, SQL Server and other services on the machine use it too, so test them after the restart. TLS 1.3 server support in Schannel requires Windows Server 2022 or later. See Microsoft's TLS registry settings reference for the full list of keys.

Cloudflare and other CDNs

In Cloudflare, go to SSL/TLS → Edge Certificates, set Minimum TLS Version to TLS 1.2, and make sure TLS 1.3 is on. Both settings are on the free plan. Remember this only covers the connection from visitors to Cloudflare. Your origin server needs its own change, as described above. Our Cloudflare free plan settings guide covers the other SSL options worth changing.

Other CDNs and managed platforms (AWS CloudFront, Azure Front Door, Shopify, Squarespace, Wix) manage TLS themselves or offer a minimum-version setting in their security policy. Check the provider's documentation rather than assuming.

Step 4: Verify and watch

1. Run the TLS Version Checker again. TLS 1.0 and 1.1 should now show as disabled.
2. Repeat the openssl tests against the origin IP, other hostnames and mail ports.
3. Keep an eye on error logs and support emails for a few days, especially from the integrations you identified in Step 2.
4. Check your certificate setup at the same time with our SSL Checker. Our guide on how to check an SSL certificate explains expiry, issuer and chain.

TLS settings tend to change back after server rebuilds, control panel updates and migrations. MakeItFlow Website Monitoring (Starter plan and up) re-scans saved sites daily or weekly and emails you when the audit score changes. Repeating the TLS check after any server change is a sensible habit too.

FAQ

How do I know if my website still supports TLS 1.0?

Use an online TLS version checker, or run openssl s_client -connect yourdomain:443 -tls1 with -cipher 'DEFAULT@SECLEVEL=0' so your own client is allowed to offer the old protocol. If the handshake succeeds, TLS 1.0 is still enabled. Test your origin server and mail ports separately if you use a CDN.

Will disabling TLS 1.0 and 1.1 break my website for visitors?

Not for people using current browsers, which haven't used these versions since 2020. The risk is with old devices and integrations, such as legacy payment terminals, unsupported Android versions or old .NET and Java applications. Log the protocol versions clients use for a week before you switch them off.

Should I disable TLS 1.2 as well?

No, not for a normal business website. TLS 1.2 is still considered secure with modern cipher suites, and some business software and older operating systems don't support TLS 1.3 yet. Run TLS 1.2 and 1.3 together.

Is TLS 1.0 still allowed under PCI DSS?

No. The PCI Security Standards Council set 30 June 2018 as the deadline for removing SSL and early TLS from environments that handle card data. If you take payments on your own server, old TLS versions will be flagged in compliance scans.

I changed the setting but the checker still shows TLS 1.0. Why?

Usually another configuration line overrides yours, such as an ssl_protocols or SSLProtocol line in a virtual host or an included file, or the service wasn't reloaded. If you use a CDN, you may have changed the origin while the test hits the CDN edge, or the other way round. On Windows, Schannel changes need a restart.

Does my email server need TLS 1.0 disabled too?

Yes, ideally. SMTP, IMAP and POP3 have their own TLS settings, separate from the web server, and they often still allow old versions. Test ports 465, 587 and 993 and update Exim, Postfix, Dovecot or Exchange settings to match.