Server supports TLS 1.0/1.1 — how to disable

What's wrong

TLS 1.0 and 1.1 are officially deprecated (RFC 8996) and browsers haven't used them since 2020. Supporting them enables weak ciphers and lowers your grade in scanners and audits (PCI DSS requires turning them off).

How to fix

nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

Apache

SSLProtocol -all +TLSv1.2 +TLSv1.3

If nginx sits behind a load balancer or CDN, change the setting where TLS is terminated.

Who is affected

Only very old clients: Android 4.3 and below, unpatched IE on Windows 7, ancient Java. Fine for a public site in 2026; for APIs with long-lived integrations, check your logs first ($ssl_protocol in the nginx log format).

Check it with SSL Checker, "Protocols" tab.