# SSL error blocks access from certain browsers/networks using apache2 **URL:** \ **Category:** Help\ **Created:** [February 17, 2022, 1:00am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203 "2022-02-17T01:00:29Z")\ **Posts on this page:** 14\ **Page:** 2
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 17, 2022, 2:49am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/22 "2022-02-17T02:49:21Z")
Ehm... If you don't have a _specific_ reason to keep TLS 1.0 and 1.1 enabled, turn them off. Check [https://ssl-config.mozilla.org](https://ssl-config.mozilla.org) ---
**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\ **Post date:** [February 17, 2022, 3:06am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/23 "2022-02-17T03:06:54Z")
what is the significance of turning them off compared to what I have running now? I entered my settings in the form there and it produced this ```nohighlight # generated 2022-02-17, Mozilla Guideline v5.6, Apache 2.4.38, OpenSSL 1.1.1d, modern configuration # https://ssl-config.mozilla.org/#server=apache&version=2.4.38&config=modern&openssl=1.1.1d&guideline=5.6 # this configuration requires mod_ssl, mod_socache_shmcb, mod_rewrite, and mod_headers RewriteEngine On RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/ RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L] SSLEngine on SSLCertificateFile /path/to/signed_cert_and_intermediate_certs SSLCertificateKeyFile /path/to/private_key # enable HTTP/2, if available Protocols h2 http/1.1 # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) Header always set Strict-Transport-Security "max-age=63072000" # modern configuration SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2 SSLHonorCipherOrder off SSLSessionTickets off SSLUseStapling On SSLStaplingCache "shmcb:logs/ssl_stapling(32768)" ``` Not sure what to do with that data or how to turn off TLS 1.0 & 1.1 ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 17, 2022, 3:27am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/24 "2022-02-17T03:27:59Z")
There are some vulnerabilities. I wouldn't turn off TLS 1.2. (I'd use the intermediate config, only use the modern one you you know your clients very well) Don't enable http strict transport security until you understand what it does, please. ---
**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\ **Post date:** [February 17, 2022, 3:32am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/25 "2022-02-17T03:32:24Z")
Am I supposed to put this in each le-ssl.conf for each VirtualHost or in the file `/etc/letsencrypt/options-ssl-apache2.conf` ? ```nohighlight # intermediate configuration SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 SSLHonorCipherOrder off SSLSessionTickets off ``` And does this section mess up my current ReWrite settings in the regular .conf file? Do I just add it to the bottom before `` ? ```nohighlight RewriteEngine On RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/ RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L] ``` ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 17, 2022, 3:35am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/26 "2022-02-17T03:35:30Z")
Leave it alone. When you have some time, pick it back up. I'm not going to tell you to mess with a system that's working. If you just want to turn off TLS 1.0 and 1.1, find the `SSLProtocol` directive on your server and modify it like the example. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 17, 2022, 3:40am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/27 "2022-02-17T03:40:22Z")
I just realized that config comes with your very old version of certbot. You can replace it if you know what you're doing, but it's probably better to just upgrade certbot. ---
**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\ **Post date:** [February 17, 2022, 3:40am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/28 "2022-02-17T03:40:47Z")
Thanks so much for everything. You are awesome. I will read about TLS and OCSP Stapling when I have time. I'm sure I'll figure it out. You guys have helped so much. Wish I could buy you a coffee. All I have is Ravencoin. ---
**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\ **Post date:** [February 17, 2022, 3:42am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/29 "2022-02-17T03:42:16Z")
This config ? `/etc/letsencrypt/options-ssl-apache2.conf ` Well my system is Debian 10. I have been thinking of upgrading to Bullseye maybe they have a newer version. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 17, 2022, 3:43am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/30 "2022-02-17T03:43:08Z")
Yes, that one. Currently certbot is distributed using snap, the version in apt is probably old in Debian 11 too. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 17, 2022, 4:04am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/31 "2022-02-17T04:04:51Z")
[side note:] [Thanks for the 🍺] [Cheers from Miami] ---
**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\ **Post date:** [February 17, 2022, 4:33am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/32 "2022-02-17T04:33:19Z")
No prob RG @9peppe if you have a paypal or XMR / RVN I can send you a few for your help as well. Cant thank you two enough. I was trying to get this solved for a few weeks and overlooked that issue completely. I'm off to do my thing, peace. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 17, 2022, 4:35am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/33 "2022-02-17T04:35:13Z")
Don't worry about it 😉 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 17, 2022, 7:36am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/34 "2022-02-17T07:36:54Z")
> [@pastlife](#): > > Cant thank you two enough. You could. And you did. 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 19, 2022, 7:37am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/35 "2022-03-19T07:37:30Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203.md?page=1)