# Enable TLS 1.0 & TLS 1.1 in haproxy 2.4

**URL:** <https://discourse.haproxy.org/t/enable-tls-1-0-tls-1-1-in-haproxy-2-4/8545>\
**Category:** Help!\
**Created:** [March 28, 2023, 8:32am UTC](https://discourse.haproxy.org/t/enable-tls-1-0-tls-1-1-in-haproxy-2-4/8545 "2023-03-28T08:32:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![HansMeiser](https://avatars.discourse-cdn.com/v4/letter/h/919ad9/32.png) [@HansMeiser](https://discourse.haproxy.org/u/HansMeiser)\
**Post date:** [March 28, 2023, 8:32am UTC](https://discourse.haproxy.org/t/enable-tls-1-0-tls-1-1-in-haproxy-2-4/8545/1 "2023-03-28T08:32:12Z")

</div>

Hello,

currently i use haproxy 2.4 18 on Ubuntu 22.04 and openssl 3.0.2

For an internal application we use a haproxy cluster as failoversystem. i try to reenable TLS 1.0 & TLS 1.1 in haproxy. I know this is generally a bad idea, because every modern application should be able to talk TLS 1.2 & TLS 1.3, but we have a specific financial application in inttranet which is doing a run through haproxy and now is not able to make ssl handshake anymore.

I tried to reenable TLS 1.0 & TLS 1.1 with usual configuration options like ssl-min-ver or even force-tlsv10, but nothing works. TLS 1.0 & TLS 1.1 are not offered in ssl handshake.

I read some posts that with openssl 3.0.1 TLS1.0 & TLS 1.1 were moved to different SECLEVEL, but every change i do in my haproxy.cfg has no effect.

haproxy tells that config file is valid and also it tells that “OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3” is available, but it has no practical effect.

Is there anybody who has a working configuration to reeneble TLS 1.0 & TLS 1.1 or some other hints to solve my problem?

Thanks,  
Hans

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 28, 2023, 9:10am UTC](https://discourse.haproxy.org/t/enable-tls-1-0-tls-1-1-in-haproxy-2-4/8545/2 "2023-03-28T09:10:08Z")

</div>

To convince openssl 3.0 to allow TLSv1.0 additional steps are required.

You can append `:@SECLEVEL=0` to `ssl-default-bind-ciphers` or manually edit your openssl.cnf to lower the SECLEVEL to 0.

---

<div class="post-metadata">

**Author:** ![HansMeiser](https://avatars.discourse-cdn.com/v4/letter/h/919ad9/32.png) [@HansMeiser](https://discourse.haproxy.org/u/HansMeiser)\
**Post date:** [March 28, 2023, 9:46am UTC](https://discourse.haproxy.org/t/enable-tls-1-0-tls-1-1-in-haproxy-2-4/8545/3 "2023-03-28T09:46:24Z")

</div>

Hello,

thank you, this is working. I think i tricked my self. I had this kind of configuration already tested, but my test was using “openssl s\_client”, which was not working with tls 1.0 and 1.1. But i think this was based on openssl Configuration itself. I used an other ssl-analyzer and this shows tls1.0 and 1.1 again.

Thank you,  
Hans

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 28, 2023, 10:58am UTC](https://discourse.haproxy.org/t/enable-tls-1-0-tls-1-1-in-haproxy-2-4/8545/4 "2023-03-28T10:58:48Z")

</div>

Correct, the openssl ssl client has the same exact problem.