# How to disable TLS v1.0 & v1.1 in HAProxy?

**URL:** <https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439>\
**Category:** Help!\
**Created:** [February 23, 2022, 10:09am UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439 "2022-02-23T10:09:52Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![RKProxy](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@RKProxy](https://discourse.haproxy.org/u/RKProxy)\
**Post date:** [February 23, 2022, 10:09am UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/1 "2022-02-23T10:09:52Z")

</div>

Hi,

For our application, it shows **TLS v1.0 & v1.1 are enabled**. We need to disable it.

 ![Screenshot 2022-02-23 at 3.31.47 PM](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/7/7f2f20ad93dcdd81e653c31c71b068f936d0947e.png)

We checked the haproxy config file file & added this:

```auto
frontend ssl
bind 0.0.0.0:443 ssl crt /etc/haproxy/ssl_cert.pem ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 force-tlsv12 ca-file /etc/haproxy/ssl_ca_cert.pem no-tlsv11 no-tlsv10 no-sslv3 verify optional

```

**But still, it shows as enabled.**

What are we missing here? Let us know if you need the complete config file.

Thanks.

---

<div class="post-metadata">

**Author:** ![rhada](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/rhada/32/585_2.png) [@rhada](https://discourse.haproxy.org/u/rhada)\
**Post date:** [February 23, 2022, 2:33pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/2 "2022-02-23T14:33:44Z")

</div>

Hello,

Here we use

```auto
ssl-default-server-options no-sslv3 ssl-min-ver TLSv1.2

```

And result seems OK BUT we get a warning at startup :

```auto
no-sslv3/no-tlsv1x are ignored for server 'my_server'. Use only 'ssl-min-ver' and 'ssl-max-ver' to fix.

```

You can get rid of it with a line like

```auto
ssl-default-server-options ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.2

```

Help it can help 🙂

---

<div class="post-metadata">

**Author:** ![RKProxy](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@RKProxy](https://discourse.haproxy.org/u/RKProxy)\
**Post date:** [February 23, 2022, 2:52pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/3 "2022-02-23T14:52:30Z")

</div>

> [@rhada](#):
>
> `ssl-min-ver`

This syntax does not work in version 1.5.8

---

<div class="post-metadata">

**Author:** ![rhada](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/rhada/32/585_2.png) [@rhada](https://discourse.haproxy.org/u/rhada)\
**Post date:** [February 23, 2022, 3:22pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/4 "2022-02-23T15:22:17Z")

</div>

Haproxy 1.5 is quite old. Not sure if still maintained.

You should consider to uprgrade.

Regarding your issue, you have to check the [doc](http://cbonte.github.io/haproxy-dconv/1.5/configuration.html) to find the appropriate config

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 23, 2022, 3:51pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/5 "2022-02-23T15:51:42Z")

</div>

```
no-tlsv11 no-tlsv10 no-sslv3

```

This configuration is correct, the configuration may not be properly applied (old haproxy instance running in the background with old configurations), you may hit a bug, or your measurements may not be accurate.

Provide the output of `haproxy -vv` and openssl outputs from the haproxy machine (not a far end device crossing firewalls and other security devices, you may have SSL intercepting devices in the path), but `127.0.0.1:443` :

```
openssl s_client -tls1 127.0.0.1:443
openssl s_client -tls1_1 127.0.0.1:443
openssl s_client -tls1_2 127.0.0.1:443
```

---

<div class="post-metadata">

**Author:** ![ravi.soni](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@ravi.soni](https://discourse.haproxy.org/u/ravi.soni)\
**Post date:** [February 24, 2022, 10:26am UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/7 "2022-02-24T10:26:04Z")

</div>

![MicrosoftTeams-image](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/c/c08b794402788ec7846c11ca0a4b94892aa60e72.png)

Please find the haproxy version screenshot .

1.For This we getting error after run those below commands.

openssl s\_client -tls1 127.0.0.1:443  
openssl s\_client -tls1\_1 127.0.0.1:443  
openssl s\_client -tls1\_2 127.0.0.1:443

**Command Not Found**

2.But We run the command openssl for cipher we getting output below.

ravi@admins-/ % openssl s\_client -connect developernexus.ob.globalbank.sbi:443 -cipher “EDH”

CONNECTED(00000005)

depth=2 C = US, O = “Entrust, Inc.”, OU = See [Legal and Compliance](http://www.entrust.net/legal-terms), OU = “(c) 2009 Entrust, Inc. - for authorized use only”, CN = Entrust Root Certification Authority - G2

verify return:1

depth=1 C = US, O = “Entrust, Inc.”, OU = See [Legal and Compliance](http://www.entrust.net/legal-terms), OU = “(c) 2012 Entrust, Inc. - for authorized use only”, CN = Entrust Certification Authority - L1K

verify return:1

* * *

verify return:1

* * *

Certificate chain

0 \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

i:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K

1 s:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K

i:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

2 s:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

i:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

* * *

Server certificate

-----BEGIN CERTIFICATE-----

“”\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*""

-----END CERTIFICATE-----

subject=\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

issuer=/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K

* * *

No client certificate CA names sent

Server Temp Key: DH, 1024 bits

* * *

SSL handshake has read 4849 bytes and written 302 bytes

* * *

New, TLSv1/SSLv3, Cipher is “\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*”  
Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

Protocol : TLSv1.2

Cipher : \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Session-ID: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Session-ID-ctx:

Master-Key: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Start Time: 1645684131

Timeout : 7200 (sec)

Verify return code: 0 (ok)

* * *

HTTP/1.0 408 Request Time-out

Cache-Control: no-cache

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 24, 2022, 11:25am UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/8 "2022-02-24T11:25:40Z")

</div>

You need to run those commands on the haproxy box against `127.0.0.1:443`. If you are missing the local openssl tool, install it.

---

<div class="post-metadata">

**Author:** ![higor.s](https://avatars.discourse-cdn.com/v4/letter/h/bcef8e/32.png) [@higor.s](https://discourse.haproxy.org/u/higor.s)\
**Post date:** [January 31, 2023, 7:02pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/9 "2023-01-31T19:02:07Z")

</div>

**ssl-default-bind-options no-sslv3 no-tlsv11 no-tlsv10**  
Worked for me!

---

<div class="post-metadata">

**Author:** ![rs1234](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rs1234](https://discourse.haproxy.org/u/rs1234)\
**Post date:** [February 24, 2023, 2:11pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/10 "2023-02-24T14:11:24Z")

</div>

Sorry to re-activate the conversation again, I’m using HAproxy 2.4.x and tried all possible syntax but still not disabling tls1.1 and 1.0, Am I missing something?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 24, 2023, 3:37pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/11 "2023-02-24T15:37:57Z")

</div>

_It also depends on the openssl release, you are probably running v3.0._

_You can append `:@SECLEVEL=0` to `ssl-default-bind-ciphers` or manually edit your `openssl.cnf` to lower the SECLEVEL to 0._

**Forget what I said, I got the question wrong.**

---

<div class="post-metadata">

**Author:** ![rs1234](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rs1234](https://discourse.haproxy.org/u/rs1234)\
**Post date:** [February 24, 2023, 7:37pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/12 "2023-02-24T19:37:08Z")

</div>

Thank you for the reply @lukastribus could you give me the exact syntax for openssl.cnf? I’m using openssl 1.1.1

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 24, 2023, 8:26pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/13 "2023-02-24T20:26:13Z")

</div>

I’m sorry, I realize I got the question wrong.

Please refer to post #5 in this thread.

> [@How to disable TLS v1.0 & v1.1 in HAProxy?](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/5):
>
> no-tlsv11 no-tlsv10 no-sslv3 This configuration is correct, the configuration may not be properly applied (old haproxy instance running in the background with old configurations), you may hit a bug, or your measurements may not be accurate. Provide the output of haproxy -vv and openssl outputs from the haproxy machine (not a far end device crossing firewalls and other security devices, you may have SSL intercepting devices in the path), but 127.0.0.1:443 : openssl s\_client -tls1 127.0.0.1:443…

If this doesn’t work for you, provide the outputs request in that post.

---

<div class="post-metadata">

**Author:** ![rs1234](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rs1234](https://discourse.haproxy.org/u/rs1234)\
**Post date:** [February 24, 2023, 8:46pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/14 "2023-02-24T20:46:46Z")

</div>

That didn’t work unfortunately:

HAProxy version 2.4.4-acb1d0b 2021/09/07 - [https://haproxy.org/](https://haproxy.org/)  
Status: long-term supported branch - will stop receiving fixes around Q2 2026.  
Known bugs: [http://www.haproxy.org/bugs/bugs-2.4.4.html](http://www.haproxy.org/bugs/bugs-2.4.4.html)  
Running on: Linux 3.10.0-1160.36.2.el7.x86\_64 #1 SMP Wed Jul 21 11:57:15 UTC 2021 x86\_64  
Build options :  
TARGET = linux-glibc  
CPU = generic  
CC = cc  
CFLAGS = -O2 -g -Wall -Wextra -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wtype-limits  
OPTIONS = USE\_PCRE=1 USE\_OPENSSL=1 USE\_ZLIB=1 USE\_SYSTEMD=1  
DEBUG =

Feature list : +EPOLL -KQUEUE +NETFILTER +PCRE -PCRE\_JIT -PCRE2 -PCRE2\_JIT +POLL -PRIVATE\_CACHE +THREAD -PTHREAD\_PSHARED +BACKTRACE -STATIC\_PCRE -STATIC\_PCRE2 +TPROXY +LINUX\_TPROXY +LINUX\_SPLICE +LIBCRYPT +CRYPT\_H +GETADDRINFO +OPENSSL -LUA +FUTEX +ACCEPT4 -CLOSEFROM +ZLIB -SLZ +CPU\_AFFINITY +TFO +NS +DL +RT -DEVICEATLAS -51DEGREES -WURFL +SYSTEMD -OBSOLETE\_LINKER +PRCTL +THREAD\_DUMP -EVPORTS -OT -QUIC -PROMEX -MEMORY\_PROFILING

Default settings :  
bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX\_THREADS=64, default=2).  
Built with OpenSSL version : OpenSSL 1.1.1 11 Sep 2018  
Running on OpenSSL version : OpenSSL 1.1.1 11 Sep 2018  
OpenSSL library supports TLS extensions : yes  
OpenSSL library supports SNI : yes  
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3  
Built with network namespace support.  
Built with zlib version : 1.2.7  
Running on zlib version : 1.2.7  
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)  
Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND  
Built with PCRE version : 8.32 2012-11-30  
Running on PCRE version : 8.32 2012-11-30  
PCRE library supports JIT : no (USE\_PCRE\_JIT not set)  
Encrypted password support via crypt(3): yes  
Built with gcc compiler version 4.8.5 20150623 (Red Hat 4.8.5-44)

Available polling systems :  
epoll : pref=300, test result OK  
poll : pref=200, test result OK  
select : pref=150, test result OK  
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :  
(protocols marked as cannot be specified using ‘proto’ keyword)  
h2 : mode=HTTP side=FE|BE mux=H2 flags=HTX|CLEAN\_ABRT|HOL\_RISK|NO\_UPG  
fcgi : mode=HTTP side=BE mux=FCGI flags=HTX|HOL\_RISK|NO\_UPG  
 : mode=HTTP side=FE|BE mux=H1 flags=HTX  
h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO\_UPG  
 : mode=TCP side=FE|BE mux=PASS flags=  
none : mode=TCP side=FE|BE mux=PASS flags=NO\_UPG

Available services : none

Available filters :  
[SPOE] spoe  
[CACHE] cache  
[FCGI] fcgi-app  
[COMP] compression  
[TRACE] trace

* * *

And haproxy.cnf  
global  
ssl-default-bind-ciphers TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:EECDH+AESGCM:EECDH+CHACHA20  
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11  
log /dev/log local0  
chroot /var/lib/haproxy  
pidfile /var/run/haproxy.pid  
maxconn 4000  
user haproxy  
group haproxy  
daemon  
stats socket /var/lib/haproxy/stats  
tune.ssl.default-dh-param 2048

* * *

## CONNECTED(00000003) 139630862251920:error:1409442E:SSL routines:ssl3\_read\_bytes:tlsv1 alert protocol version:s3\_pkt.c:1493:SSL alert number 70 139630862251920:error:1409E0E5:SSL routines:ssl3\_write\_bytes:ssl handshake failure:s3\_pkt.c:659:

## no peer certificate available

## No client certificate CA names sent

## SSL handshake has read 7 bytes and written 0 bytes

## New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1677271775 Timeout : 7200 (sec) Verify return code: 0 (ok)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 24, 2023, 11:25pm UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/15 "2023-02-24T23:25:54Z")

</div>

What makes you think that the configuration doesn’t work, specifically?

As per the output you provided, TLSv1.1 is _NOT_ negotiated.

---

<div class="post-metadata">

**Author:** ![rs1234](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rs1234](https://discourse.haproxy.org/u/rs1234)\
**Post date:** [February 25, 2023, 2:32am UTC](https://discourse.haproxy.org/t/how-to-disable-tls-v1-0-v1-1-in-haproxy/7439/16 "2023-02-25T02:32:38Z")

</div>

Thank you so much @lukastribus. I was getting confused with haproxy -vv output which says the OpenSSL library supports: TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3.  
Thank you so much for your help.