Skip to main content
Sign in Support

SSL/TLS Remediation Guide: Disabling Weak Protocols (TLS 1.0 & 1.1)

Arupa Care
  • Updated

⚠️ Disclaimer

This document serves as a reference knowledge base for informational purposes only. The configurations, recommendations, and remediation steps outlined here are intended as a general guide — not a definitive or universally applicable solution.

Any changes made to your server infrastructure based on this document are entirely at your own discretion and risk. You, as the server owner or administrator, are solely responsible for evaluating the applicability of these recommendations to your specific environment, compliance requirements, and operational constraints.

Always test changes in a non-production environment before applying them to live systems.

1. Security Awareness: Why This Matters Now

⛔
CRITICAL FINDING: Actively Vulnerable to Man-in-the-Middle (MitM) Attacks CRITICAL: Vulnerable to Man-in-the-Middle (MitM) Attacks TLS 1.0 and TLS 1.1 are officially deprecated by the IETF (RFC 8996) and banned under PCI DSS, HIPAA, and NIST standards. Servers still accepting these protocols are actively exposed to exploitation. Every unpatched day increases risk.

A security assessment that detects support for TLS 1.0 and TLS 1.1 indicates a critical vulnerability. These cryptographic protocols were officially deprecated by the Internet Engineering Task Force (IETF) in March 2021. Continuing to operate these protocols exposes sensitive data, users, and system integrity to real-world attacks.

1.1 Real-World Risks

When a server supports weak protocols, an attacker positioned between your server and a user can:

  • Intercept and decrypt HTTPS traffic using BEAST, POODLE, or CRIME attack techniques
  • Steal session tokens, credentials, or sensitive business data
  • Inject malicious content into pages served to legitimate users
  • Downgrade encrypted connections to weaker ciphers without detection

1.2 Protocol Risk Overview

Protocol Released Known Vulnerabilities Action Required
TLS 1.0 1999 POODLE, BEAST, CRIME DISABLE
TLS 1.1 2006 POODLE, RC4 Cipher Weaknesses DISABLE
TLS 1.2 2008 Minimal (config-dependent) ENABLE ✓
TLS 1.3 2018 None known ENABLE ✓
ℹ
The Good News This vulnerability has a well-documented, tested remediation. Migrating to TLS 1.2 and TLS 1.3 can be completed in under 2 hours for most platforms.

2. Technical Remediation Instructions

Follow the section that matches your server platform. If you run multiple platforms, apply remediation to each one.

⚡

Before You Begin — Mandatory Pre-Checks

  • Take a full configuration backup before making any changes
  • Schedule changes during a maintenance window; a server restart is required
  • Test in a staging environment first if available
  • Confirm all clients/browsers support TLS 1.2+ (all modern browsers since 2014 do)

2.1 Windows Server & IIS

Windows Server manages TLS protocol support through the Windows Registry. Two methods are available:

Method A: Manual Registry Edit (PowerShell)

Open PowerShell as Administrator and run the commands below one section at a time.

Step 1 — Disable TLS 1.0

# Disable TLS 1.0 - Server $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 1 -Type DWord # Disable TLS 1.0 - Client $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 1 -Type DWord

Step 2 — Disable TLS 1.1

# Disable TLS 1.1 - Server $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 1 -Type DWord # Disable TLS 1.1 - Client $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 1 -Type DWord

Step 3 — Enable TLS 1.2 and TLS 1.3

# Enable TLS 1.2 - Server $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 0 -Type DWord # Enable TLS 1.2 - Client $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 0 -Type DWord # Enable TLS 1.3 - Server (Windows Server 2022 / Windows 11+) $path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' New-Item -Path $path -Force | Out-Null Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord Set-ItemProperty -Path $path -Name 'DisabledByDefault' -Value 0 -Type DWord

Step 4 — Restart the server

Restart-Computer -Force

Method B: IIS Crypto (GUI Tool — Recommended for Beginners)

  1. Download IIS Crypto from: https://www.nartac.com/Products/IISCrypto
  2. Run as Administrator
  3. Click Best Practices — this automatically disables TLS 1.0/1.1 and enables TLS 1.2/1.3
  4. Click Apply, then restart the server when prompted

2.2 Nginx

Nginx TLS configuration is managed in the server { } block of your virtual host configuration file.

Step 1 — Open your Nginx configuration file

sudo nano /etc/nginx/sites-available/your-domain.conf # or sudo nano /etc/nginx/nginx.conf

Step 2 — Update the ssl_protocols directive

server { listen 443 ssl; server_name your-domain.com; # TLS Protocol — disable 1.0 and 1.1 ssl_protocols TLSv1.2 TLSv1.3; # Recommended Cipher Suites ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; ssl_prefer_server_ciphers off; # Session settings ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; ssl_session_tickets off; # OCSP Stapling ssl_stapling on; ssl_stapling_verify on; # HSTS (1 year) add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; }

Step 3 — Test and reload Nginx

# Test for syntax errors sudo nginx -t # Expected: nginx: configuration file ... syntax is ok # Reload Nginx sudo systemctl reload nginx

2.3 Apache HTTP Server

Step 1 — Open your Apache SSL virtual host file

# Debian / Ubuntu sudo nano /etc/apache2/sites-available/your-domain-ssl.conf # RHEL / CentOS sudo nano /etc/httpd/conf.d/ssl.conf

Step 2 — Update the SSLProtocol directive

<VirtualHost *:443> ServerName your-domain.com SSLEngine on SSLCertificateFile /path/to/certificate.crt SSLCertificateKeyFile /path/to/private.key # Disable ALL, then re-enable only TLS 1.2 and 1.3 SSLProtocol -all +TLSv1.2 +TLSv1.3 # Recommended Cipher Suite SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\ ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\ ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 SSLHonorCipherOrder off # HSTS Header Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" </VirtualHost>
ℹ
Directive explained: SSLProtocol -all +TLSv1.2 +TLSv1.3 — -all disables every protocol including SSLv2/v3, then +TLSv1.2 and +TLSv1.3 selectively re-enable only the secure versions.

Step 3 — Enable modules, test, and restart

# Enable required modules (Debian/Ubuntu) sudo a2enmod ssl headers # Test for configuration errors sudo apachectl configtest # Expected: Syntax OK # Restart Apache sudo systemctl restart apache2 # Debian/Ubuntu sudo systemctl restart httpd # RHEL/CentOS

2.4 XAMPP

⚡
Production Warning: XAMPP is a development environment tool. If your XAMPP instance serves real users, migrate to a hardened Apache or Nginx deployment as soon as possible. Apply this fix as an interim measure only.

Step 1 — Locate the SSL configuration file

# Windows C:\xampp\apache\conf\extra\httpd-ssl.conf # Linux /opt/lampp/etc/extra/httpd-ssl.conf # macOS /Applications/XAMPP/xamppfiles/etc/extra/httpd-ssl.conf

Step 2 — Edit httpd-ssl.conf: update SSLProtocol and SSLCipherSuite

# BEFORE (insecure — comment out or remove): # SSLProtocol all -SSLv2 -SSLv3 # SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 # AFTER (secure — replace with): SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\ ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\ ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 SSLHonorCipherOrder off

Step 3 — Restart XAMPP Apache

# Option A: XAMPP Control Panel # Click Stop next to Apache → wait 5 seconds → click Start # Option B: Windows Command Prompt (as Administrator) C:\xampp\apache\bin\httpd.exe -k restart # Option C: Linux / macOS Terminal sudo /opt/lampp/lampp restartapache

3. Verification — Confirming Successful Remediation

After applying changes and restarting your server, use the following methods to confirm that weak protocols are disabled.

3.1 Method 1: OpenSSL Command-Line Test

Run these tests from any machine that can reach your server. Replace your-domain.com with your actual domain.

Test TLS 1.0 — must be REJECTED

openssl s_client -connect your-domain.com:443 -tls1 # ✅ Expected (TLS 1.0 correctly DISABLED): # error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

Test TLS 1.1 — must be REJECTED

openssl s_client -connect your-domain.com:443 -tls1_1 # ✅ Expected (TLS 1.1 correctly DISABLED): # error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

Test TLS 1.2 — must be ACCEPTED

openssl s_client -connect your-domain.com:443 -tls1_2 # ✅ Expected (TLS 1.2 correctly ENABLED): # CONNECTED(00000003) # Protocol : TLSv1.2 # Cipher : ECDHE-RSA-AES256-GCM-SHA384 # Verify return code: 0 (ok)

Test TLS 1.3 — must be ACCEPTED

openssl s_client -connect your-domain.com:443 -tls1_3 # ✅ Expected (TLS 1.3 correctly ENABLED): # CONNECTED(00000003) # Protocol : TLSv1.3 # Cipher : TLS_AES_256_GCM_SHA384 # Verify return code: 0 (ok)

3.2 Method 2: Qualys SSL Labs Online Scanner

  1. Go to: https://www.ssllabs.com/ssltest/
  2. Enter your domain name and click Submit
  3. Wait 1–3 minutes for the full analysis
  4. Interpret your grade using the table below
Grade Score What It Means
A+ 95–100 Excellent — best practices applied including HSTS preloading
A 80–94 Strong — TLS 1.2/1.3, modern ciphers, valid certificate
B 65–79 Acceptable — some configuration improvements recommended
C–F <65 Failing — weak protocols, broken ciphers, or certificate issues present

Target grade after remediation: A or A+ — SSL Labs Grade A requires TLS 1.2+ with strong cipher suites.

✔
Verification Passed If TLS 1.0 and TLS 1.1 connections are rejected and TLS 1.2 / TLS 1.3 connections succeed, your remediation is complete. Your server is no longer vulnerable to weak-protocol MitM attacks.

5. References & Further Reading

This article is maintained by the Cybersecurity Team. For questions or to report inaccuracies, please contact support representative.  |  Version 1.1

Related articles