Yes, disable TLS 1.0 and 1.1. RFC 8996, published in March 2021, states that TLS 1.0 must not be used and that TLS 1.1 must not be used, and it forbids negotiating either from any TLS version. The remaining work is finding the old clients that still depend on them.
What the RFC says
RFC 8996 is a Best Current Practice. It moves the original TLS 1.0 and 1.1 specifications to Historic status and also deprecates DTLS 1.0, but not DTLS 1.2. The authors cite missing support for current cryptographic algorithms, industry mandates against the old versions, and the smaller attack surface and maintenance burden of dropping them.
Specific reasons in the document include dependence on outdated cipher suites, no support for modern AEAD ciphers, handshake integrity and peer authentication that rely on SHA-1, and the misconfiguration risk of supporting four protocol versions at once.
RFC 9325 repeats the position: implementations must not negotiate SSL 2.0, SSL 3.0, TLS 1.0 or TLS 1.1, TLS 1.2 must be supported, and TLS 1.3 should be supported and preferred.
Find out what you still accept
Run a TLS scan against your own endpoints and record which protocol versions each one offers. Check the usual places teams forget: load balancers, mail servers, VPN gateways, admin consoles, legacy API hosts and internal tools.
Then look at your access logs, if they record the negotiated protocol, to see who still connects with an old version. Many servers can log this once you add the field to the log format.
Deal with the stragglers
When logs show real clients on old versions, you usually find one of three groups:
- Old devices, such as printers, scanners or point of sale terminals, that cannot be upgraded.
- Old runtimes in internal tools that default to an old protocol.
- Partners with outdated integrations.
For each, choose a plan: upgrade, replace, isolate behind a gateway that terminates modern TLS, or set an end date and tell the owner. Do not leave the old protocol enabled for everyone because of one client.
What to set
Enable TLS 1.2 and 1.3 only. Prefer 1.3. Review your cipher suite list against current guidance, and read TLS 1.3 vs TLS 1.2 for what each version brings.
A short rollout plan
- Scan and log for two weeks to learn who still negotiates old versions.
- Contact owners of each straggler with a date.
- Disable the old versions in staging first, then in production during a quiet window.
- Re-scan and keep the scan result as evidence for audits and questionnaires.
Quick check
Is disabling TLS 1.0 enough for compliance?
Not by itself. Frameworks differ and some set their own rules. Check the specific requirement text for your framework instead of assuming.
Will browsers break if I disable TLS 1.0 and 1.1?
The RFC notes that some widely used libraries planned to drop the old versions, so current browsers generally speak TLS 1.2 or later. Verify against your own client logs.
Sources
Last reviewed: 19 October 2026.
