TLS 1.0 and TLS 1.1 are no longer supported

TLS 1.0 and TLS 1.1 are the two oldest versions of the protocol that secures HTTPS, and every major browser has removed support for them. A site that still serves them will fail for a growing share of users even though the certificate is fine, so knowing why and how is part of modern site maintenance.

Why they were removed

TLS 1.0 (1999) and TLS 1.1 (2006) carry weaknesses the later versions fix. They rely on older hash algorithms and weak cipher constructions that are vulnerable in ways TLS 1.2 and TLS 1.3 are not. Browsers and the TLS working group deprecated them, and a modern site should not offer a version that only exists to attract an attack.

Which browsers dropped them

The removal was coordinated across the major browsers, largely in 2020 with some enterprise overrides into 2021:

The practical result is that a site supporting only TLS 1.0 or 1.1 will show a connection error for current browsers. The secure baseline is TLS 1.2 minimum, with TLS 1.3 preferred where the server supports it (see the TLS 1.3 handshake guide).

Check what your server offers

1. Use OpenSSL to probe each protocol:

openssl s_client -connect example.com:443 -tls1_1 </dev/null
openssl s_client -connect example.com:443 -tls1_2 </dev/null

If the -tls1_1 probe fails with a handshake error and -tls1_2 succeeds, the old version is already off.

1. Run an external scanner such as an SSL test that shows which protocols and ciphers the server negotiates.
2. Check the certificate is current too, since a removed protocol compounds with an expired or mis-issued certificate (see the SSL errors guide).

Disable TLS 1.0 and 1.1

Set the minimum protocol version to TLS 1.2 on the server and web stack. In Nginx, the relevant directive is ssl_protocols:

ssl_protocols TLSv1.2 TLSv1.3;

In Apache, set SSLProtocol:

SSLProtocol -all +TLSv1.2 +TLSv1.3

The exact directive differs per stack, but the goal is the same: never offer TLS 1.0 or 1.1. If you use a proxy or CDN in front of the origin, also enforce the minimum there so an existing TLS 1.0 termination path is not reintroduced. When you change the configuration, reload the service and re-run the probes. For a site with a managed TLS setup, the free certificate guide covers keeping the certificate valid while you harden the version set, and the HTTP/2 negotiation guide explains how the negotiated version connects to the modern result.