I maintain several websites that use Certbot. The Qualys SSL Labs SSL Server Test has historically graded them as A+, but recently the grade has changed to B: "This server supports TLS 1.0 and TLS 1.1. Grade capped to B. " I could disable those protocols. For Apache, it would seem to require cha…

[image] dw21677: So, how can you disable TLS 1.0 and TLS 1.1, but still get configuration updates from Certbot? In Apache, search through your configuration files for "SSLProtocol". Set it to: SSLProtocol +TLSv1.2 [and restart Apache] This change will not break certbot updates.

[image] rg305: In Apache, search through your configuration files for “ SSLProtocol ”. Set it to: SSLProtocol +TLSv1.2 [and restart Apache] This change will not break certbot updates. Thanks, I tried this, except for Nginx instead of Apache. (Sorry to confuse the issue, but it's probably…

Relying on certbot for (any) future security updates is not an ideal best practice. SSL Labs can better show you when/where your systems are out of compliance; from there you can and should take steps to ensure your systems are up to your minimum security standards. And for those that do absolutel…

[image] rg305: Relying on certbot for (any) future security updates is not an ideal best practice . SSL Labs can better show you when/where your systems are out of compliance ; from there you can and should take steps to ensure your systems are up to your minimum security standards. And for th…

[image] dw21677: It’d be nice if there were some way to make the change to remove TLS 1.0 and TLS 1.1 without breaking future Certbot configuration updates. For that plan, I would keep certbot updated [and also monitor the site with SSL Labs every couple of months].

TBH, I don’t even use the Certbot Apache config. I configure my VirtualHosts manually and hold a global SSL Configuration: RHEL/CentOS: /etc/httpd/conf.d/ssl.conf Debian/Ubuntu: /etc/apache2/mods-enabled/ssl.conf SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDH+AESGCM:ECDH+CHAC…

Here is the “default” found in nginx.conf (Ubuntu 18.04 - nginx 1.14.0): ## # SSL Settings ## ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE ssl_prefer_server_ciphers on;

The most recent version of Certbot did disable TLS 1.0 and 1.1 in the Apache configuration. If you can’t upgrade Certbot, I guess you could steal its configuration file. Then there shouldn’t be problems with future upgrades. certbot/certbot/blob/v1.2.0/certbot-apache/certbot_apache/_intern…

Ubuntu Server 18.04 LTS, Apache 2.4, Certbot 0.31.0 Things I’ve tried: I tried to change SSLProtocol in the file /etc/apache2/mods-available/ssl.conf and restart the server, but it didn’t work. I searched for SSLProtocol in the main Apache configuration file /etc/apache2/apache2.conf, but it isn’…

Apache files are read top to bottom. The ssl.conf file should take the global setting, but it has to be OUTSIDE the default VirtualHost block. In your vhost config files, remove the line: Include /etc/letsencrypt/options-ssl-apache.conf I have my own SSL settings globally set in my ssl.conf file. …

Disabling TLS 1.0 and TLS 1.1

Help

Topic		Replies	Views
How to disable TLS 1.0 and 1.1 and maintain certbot updates Help	1	1616	April 23, 2021
CertBot auto configuration for Apache - TLS 1.0 and 1.1 Help	2	2056	August 22, 2019
TLS 1.0/1.1 depreciation Help	3	742	April 13, 2020
Disabling TLSv1 Help	4	894	June 17, 2020
Remove support for TLS 1.0, 1.1 in Nginx Server	12	10612	April 17, 2019

Disabling TLS 1.0 and TLS 1.1

Related topics