TLS 1.1 is enabled

Updated 2026-10-12

HighConfirmedQuick wintls.protocols.tls11-enabled

What this check looks for

The server accepts TLS 1.1, which browsers removed alongside TLS 1.0 in 2020. It offers nothing TLS 1.2 does not.

Why it matters

The IETF has deprecated it and says servers must not negotiate it, and it serves no client that is still supported. Disabling it removes a downgrade target for no loss of reach.

When the check passes, your report says: “The server refuses TLS 1.1”.

What it costs your score

When this check fails it removes 20 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.protocols family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity: high
Default confidence: confirmed
Status when triggered: fail
Deduction: 20 points
Family cap: tls.protocols · 40
Category: TLS
Module: Tls protocols
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Restrict the server to TLS 1.2 and TLS 1.3.

Nothing needs TLS 1.1, and the standards that govern TLS say not to offer it.

Set the enabled protocols to TLS 1.2 and 1.3 server-wide, then reload.
On a load balancer or CDN, choose the security policy or minimum version that starts at TLS 1.2; on IIS, disable TLS 1.1 under the Schannel Protocols registry keys and restart.
Check every other service presenting this certificate — mail, an API host, an admin port — and apply the same list there.

How to confirm it worked

openssl s_client -connect ‹host›:443 -servername ‹host› -tls1_1 </dev/null 2>&1 | tail -1 — expect a handshake failure

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

Apache

SSLProtocol             -all +TLSv1.2 +TLSv1.3
SSLHonorCipherOrder     off
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305

Caddy

‹host› {
	tls {
		protocols tls1.2 tls1.3
	}
}

Cloudflare

SSL/TLS → Edge Certificates → Minimum TLS Version → TLS 1.2.

Put this in the http block so it applies to every server block; a per-server ssl_protocols directive silently overrides it for that server only.
Set it in the main configuration, not in .htaccess — SSLProtocol is a server-context directive and .htaccess cannot change it.
Caddy already defaults to TLS 1.2 and 1.3; an explicit block is only needed to pin them.
This setting governs the connection between visitors and Cloudflare's edge only. It does not change what the origin server negotiates, and an origin that is reachable directly — by IP, or through any DNS record that is not proxied — still accepts what it accepted before. This scan measured the origin, so apply the server-side configuration as well.

Technical detail

A TLS 1.1 handshake succeeded against ‹host›. ‹source›. TLS 1.1 fixed the predictable-IV problem of TLS 1.0 but kept SHA-1 in the PRF and has no AEAD suites, so it inherits the Lucky 13 class of attacks. Every browser that supports TLS 1.1 also supports TLS 1.2.

RFC 8996 (2021) deprecated TLS 1.1 formally, and Chrome, Firefox, Safari and Edge had already stopped negotiating it in 2020. The clients that still need it are the same ones that need TLS 1.0: systems more than a decade out of date, which in practice cannot validate today's certificate chains either.

TLS 1.1 is almost never switched on deliberately. It survives inside an old protocol list: nginx releases before 1.27.3 (November 2024) shipped a default that still included TLS 1.0 and 1.1, so a configuration with no ssl_protocols line at all inherits them, and many load balancer security policies written before 2020 do the same. nginx documents that a list set in one server block may be overridden by the default server's list for the same address and port, so set it in the http block. If this scan also reported TLS 1.0, the same edit fixes both.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the tls protocols checker Build the fix