Should I disable TLS 1.0 and TLS 1.1. support and get an A at SSL Labs?

Yes but Apache is notorious for running at all cost.
Which means that there may be multiple SSLProtocol statements.
And even though they all will be processed and must by syntaxically correct, the last one is the one that will eventually be used.

So technically that amounts to a parameter/statement overlap/overwrite - but Apache says nothing to you about it.

If I had to guess, I would say that you are modifying one in the default file or main config file and there exists another via an include statement.

Try:
grep -Ri SSLProtocol /etc/apache2/

1 Like