What is the difference between the TLS versions (TLS 1.0, 1.1, 1.2, 1.3)?

Short answer

Each TLS version has removed the weak algorithms of the previous one and simplified the handshake. TLS 1.0 and 1.1 have been deprecated; TLS 1.2 is the most widely supported version today and is secure with strong cipher suites; TLS 1.3 contains only strong cipher suites, provides forward secrecy on every connection and reduces the full handshake to a single round trip. In TR7, the accepted version range is determined by the Min. SSL Version and Max. SSL Version fields on the TLS Security Profiles screen; Default Profile uses TLSv1.1 as the lower bound and sets no upper bound.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → TLS Security Profiles	Min. SSL Version (on in a new profile, TLSv1.1), Max. SSL Version (off; TLSv1.3 when turned on)	The accepted version range
HTTP and L7 TCP vService → Details	SSL Security	Assigning the profile to the vService; the profile that comes preselected is Default Profile
Backend Service	Backend SSL Security Profile	The version range TR7 accepts when connecting to the Backend Service
Load Balancer → Conditions (Policy Match)	SSL Version	A decision based on the version the client connected with

Comparison

Version	Release	Status
SSL 3.0	1996 (RFC 6101)	Deprecated in 2015 by RFC 7568
TLS 1.0	1999 (RFC 2246)	Deprecated in 2021 by RFC 8996
TLS 1.1	2006 (RFC 4346)	Deprecated in 2021 by RFC 8996
TLS 1.2	2008 (RFC 5246)	Widespread; recommended with cipher suites that provide forward secrecy and AEAD (RFC 9325)
TLS 1.3	2018 (RFC 8446)	Current; only AEAD cipher suites, forward secrecy on every connection, full handshake in a single round trip

Common Misconceptions

• "Allowing TLS 1.3 cuts off old clients." The version range is determined as a whole; if Min. SSL Version is left at TLSv1.2, the clients that do not support TLS 1.3 continue to connect with TLS 1.2.
• "Default Profile is strict enough for internet-facing services." Default Profile allows TLSv1.1 and cannot be edited; to turn off TLS 1.0 and 1.1, a new profile with Min. SSL Version = TLSv1.2 is defined (How do I disable TLS 1.0/1.1; is TLS 1.3 supported?).
• "The cipher suite list also determines the TLS 1.3 suites." The list in the Cipher Algorithms field is applied as the suite list of TLS 1.2 and earlier versions; on TLS 1.3 connections, the default TLS 1.3 suites of the engine are used, and all of them are strong. The TLS v1.3 Compatible set in the field contains only TLS 1.3 suite names; to limit the connection to TLS 1.3, Min. SSL Version = TLSv1.3 is selected instead of the set (What is a cipher suite?).

How it is done in the documentation

• TLS Security Profiles · Min. SSL Version
• TLS Security Profiles · Max. SSL Version
• TLS Security Profiles · The Default Profile
• SSL Version

Related questions

• How do I disable TLS 1.0/1.1; is TLS 1.3 supported?
• Can I route or block traffic based on TLS version or cipher?
• What is the difference between SSL and TLS?
• What is the TLS handshake?