how to disable TLS 1.0 and 1.1 without breaking clients

TL;DR

Measure first, then disable. Log which clients still negotiate TLS 1.0 or 1.1 for a week or two, contact or exempt the stragglers, then turn the old versions off and confirm. Almost nobody legit still needs them, but the measurement is what lets you say that with confidence.

how to disable TLS 1.0 and 1.1 without breaking clients

Use this when

• A security scan flags TLS 1.0 or 1.1 as enabled
• Compliance requires TLS 1.2 or better
• You are doing a planned TLS hardening pass
• Old protocol versions show up in your config audit

Not for

• Migrating specifically to TLS 1.3 (related, narrower)
• Cipher suite selection and ordering in depth
• Client-side TLS configuration

Steps

1. Find where the old versions are enabled.

Check your TLS terminators: load balancers, reverse proxies, CDNs, and app servers. Note every place that still allows 1.0 or 1.1.

Expected: a list of termination points with their minimum TLS version.

2. Measure who still uses the old versions.

Enable TLS version logging for one to two weeks and count connections by version. Break it down by client type so you can see whether it is real users, old integrations, or bots.

Expected: a number, usually well under one percent of traffic on modern sites.

3. Handle the stragglers.

For real clients still on old TLS: notify them with a deadline, or move them to a legacy endpoint if you must keep serving them. For bots and scanners, ignore them.

Expected: every remaining old-TLS client has a plan or an exemption.

4. Disable 1.0 and 1.1.

Set the minimum TLS version to 1.2 on each terminator from step 1. Do it in one change window so the behavior is consistent everywhere.

Expected: config shows minimum 1.2 on all termination points.

5. Verify from the outside.

Test with a TLS checker or a handshake test against each endpoint: 1.0 and 1.1 handshakes should fail, 1.2 and 1.3 should succeed.

Expected: old versions rejected, new versions working, on every endpoint.

6. Watch for breakage and re-scan.

Monitor error rates and support tickets for a few days after the change. Re-run the security scan that flagged the issue to confirm it is clear.

Expected: no spike in errors, scan no longer flags old TLS.

Variant phrasings

Turn off TLS 1.0 safely

Measure usage first, handle the stragglers, then disable and verify. The measurement is the safety.

Minimum TLS version 1.2, how to enforce

Set the minimum version at every TLS terminator, verify from outside, watch for breakage.

Will disabling TLS 1.1 break old clients

Only clients that cant do 1.2, which the measurement step quantifies. On most sites that is effectively nobody.

Why it happens

TLS 1.0 and 1.1 have known weaknesses and every major standard has deprecated them, but servers keep them enabled because nobody wants to be the one who broke a client. The fear is usually bigger than the reality: the measurement step exists to replace the fear with a number, and the number is almost always tiny.

Edge cases

• A big customer still needs 1.0: give them a dated migration deadline and a legacy endpoint in the meantime. Dont hold the whole fleet back for one client indefinitely.
• Embedded devices or old payment terminals: these are the classic stragglers. They need firmware updates or replacement, which takes months, so plan the legacy endpoint early.
• CDN vs origin mismatch: the CDN might enforce 1.2 while your origin still allows 1.0. Harden both, the scan may only see the edge.
• Internal services: dont forget internal TLS terminators. Scanners check the public edge, but internal old TLS is still old TLS.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ESQnLxqs9lGOgjf21xSlwQ