Enable TLS 1.2 and TLS 1.3 on Apache

Why it matters

The server accepts neither TLS 1.2 nor TLS 1.3, so current browsers cannot connect securely or at all. The software behind it is typically years out of date.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Check apachectl -V and openssl version. Update Apache and OpenSSL if they are too old, then set the protocols and reload.
2. Find every existing setting with grep -Rn -E 'SSLProtocol|SSLCipherSuite' /etc/apache2 /etc/httpd /etc/letsencrypt. A VirtualHost or included line overrides the global one, so change each (on RHEL-family systems the global line is in /etc/httpd/conf.d/ssl.conf).
3. Keep the previous configuration so you can roll back, and test with the openssl commands from the generic entry.

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Turn off TLS 1.0 and 1.1
• Enable TLS 1.3