Turn off TLS 1.0 and 1.1 on Caddy

Why it matters

TLS 1.0 and 1.1 are deprecated and no current browser uses them, but leaving them on lets attackers and old tools negotiate weaker encryption. Turning them off costs almost nothing today.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Caddy cannot enable TLS 1.0 or 1.1. It accepts only tls1.2 and tls1.3 and rejects any other value in the tls block.
2. If the scan sees an old version, TLS is terminated by something in front of Caddy (a load balancer, a CDN or another server listening on 443). Fix the protocol setting there.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Enable TLS 1.2 and TLS 1.3
• Enable TLS 1.3