Is TLS 1.1 no longer supported?

Is TLS 1.1 compromised?

"In January 2025 the United States CERT (Computer Emergency Readiness Team) reported that several pieces of TLS 1.1 cipher suites could be broken and recommended that they should not be used."

The following test was run in order to confirm the findings of this Wikipedia article. In addition to finding issues, we were also going to use this script to track the growth of the "TLS 1.1 in use" metric over time.

If you don't know how to use this handy little script, check out these blog posts. The code behind it. I created a basic shell script that does the following: Takes the current list of sites, looks up what information is reported by Mozilla. Generates a new list of sites that have enabled TLS 1.1 for HTTPS for SSLv3.

Takes the new list of sites, looks up what information is reported by Mozilla. Sends an email to me letting me know of any changes. After you install the Python library, you can type: python tlssnicheck.py --list --site "" --noemail And hit Enter. The above command will output a text file containing results on all of the sites you've told it to monitor. If your site isn't listed or is missing information, hit Enter and that site will not be included in the results.

This is the site that has been compromised, if I understand Wikipedia correctly, so the only way to figure out the answer to your question is to dig around and see what information has been disclosed. To get you started, let's take a look at this example output from the tlssnicheck. Snipped .

Is TLS 1.1 no longer supported?

I believe, as far as I can tell from my research, that TLS 1.

1 has been fully supported by Microsoft and Google for a long time now. I'm not sure about others, but they have been using them quite happily for quite some time.

Is there something about the way browsers implement TLS 1.1 that makes it incompatible with certain older servers? For example, if a browser supports 1.1, why would a server written before 1.1's release not be able to run on a browser with 1.1 support?

As far as I can tell, TLS 1.1 does not require any changes to the protocol itself, so this can't be a versioning conflict; the fact that TLS 1.1 uses the more efficient BEAST attack is an implementation detail not related to any of the protocol, so there must be some other difference in what a 1.1 client is allowed to do that a 1.0 client isn't, but I don't see what that could be.

So I guess my question is, why did TLS 1.0 become obsolete when, as far as I can tell, nothing has been changed in the protocol itself, only in the client/server implementation? 1 also offers the "comprehensive" extensions that 1.0 lacked (such as key agreement). However, due to backward compatibility reasons, the server must still support 1.0, because 1.1 has compatibility issues with 1.

Should TLS 1.1 be disabled?

We have a new server, which allows an app to store sensitive data, eg passwords, in encrypted form.

Now, our client has a request: Disable the 1.1 TLS protocol for that reason. We cannot comply with that request. But even if we could, it would not be a good idea.

TLS 1.1 is a rather new standard. In principle, people know what they are doing; most don't do anything strange anymore. TLS 1.0 was released in 1999. To our surprise, clients of modern web servers no longer offer any protection for older protocols, and allow TLS 1.0 as well. Even worse, many old servers also support 1. That's not OK. The question is whether we should disable TLS 1.1 for one particular service.

In our opinion, it would better to let the user configure whether to get the newest version offered by a client. In that case, we could also offer an additional option for the 1.0 protocol. What do you think? Any suggestions?

How exactly do you define 'sensible' TLS versions? That depends on what level of security you need from the client. I suppose it boils down to choosing the least restrictive option, but I'll elaborate on that a little bit.

As @michaelt mentioned, TLSv1.2 has various improvements compared to TLSv1. If the choice of TLS version is determined based on the compatibility of client software with other things (like other versions of SSL), then this may lead you towards TLSv1. But you don't mention that in your question. So I'll assume that TLSv1.2 is your primary target.

TLSv1.2 allows for faster communication, and its use can lead to increased security. This is because of reduced padding (for confidentiality) and MAC (for authenticity). In addition, it allows for larger records than TLSv1. All of these points are improvements over the protocol that TLSv1.1 uses.

One last important point: The main problem with TLSv1.1 and earlier was that they used plain text MD5 in the handshake. In other words, MD5 would be used as a symmetric encryption mechanism, as if were using only symmetric encryption. This turned out to be quite weak and has since been mitigated.