How to Disable TLS 1.0 and 1.1 (Nginx, Apache, Cloudflare)
Major browsers have removed TLS 1.0 and 1.1. Keeping them enabled does not help modern users — it only leaves weak protocol versions available for scanners and outdated clients. Our HTTPS report awards points for Modern TLS (no 1.0/1.1); if that factor fails, use this guide.
Key takeaways
- Allow only TLS 1.2 and TLS 1.3 on public HTTPS listeners.
- On Cloudflare, set the Minimum TLS Version to 1.2 (or higher).
- Reload the web server after config changes; CDN changes apply at the edge.
- Re-check with our TLS 1.3 checker or full HTTPS report — legacy protocols should show as disabled.
Why disable TLS 1.0 and 1.1?
TLS 1.0 (1999) and 1.1 (2006) lack modern cipher suites and are flagged by compliance scanners (PCI DSS and similar). TLS 1.2 remains widely supported; TLS 1.3 is faster and preferred. Disabling the old versions is a one-line change on most stacks.
Nginx
In the server block that listens on 443, set:
ssl_protocols TLSv1.2 TLSv1.3;
Remove any TLSv1 or TLSv1.1 from that list. Test with sudo nginx -t and reload Nginx.
Apache
In the SSL virtual host (or ssl.conf):
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
That keeps TLS 1.2+ and drops SSLv3 and TLS 1.0/1.1. Restart Apache after changing the config.
Cloudflare
Edge TLS is controlled in the dashboard, independent of your origin:
- Open the domain → SSL/TLS → Edge Certificates.
- Set Minimum TLS Version to TLS 1.2 (or TLS 1.3 if you only need modern browsers).
- Optionally enable TLS 1.3 if it is not already on. Origin settings under SSL/TLS → Overview (Full / Full strict) do not replace the minimum version for visitors.
Verify
Run your domain through the free HTTPS checker. Under TLS protocols, 1.0 and 1.1 should be disabled and 1.2/1.3 enabled. That also helps the Modern TLS factor on your SSL grade — see how to improve your SSL/HTTPS grade.
Check your domain