How do I disable TLS 1.0/1.1; is TLS 1.3 supported?

Short answer

TLS 1.3 is supported. To disable TLS 1.0 and 1.1, Min. SSL Version = TLSv1.2 is selected in a profile on the Certificates & PKI → TLS Security Profiles screen, and the profile is selected in the vService's Details panel, in the SSL Security module; if Max. SSL Version is left off or TLSv1.3 is selected, TLS 1.3 is used. Since the default profile (Default Profile) allows TLS 1.1 and cannot be edited, a new profile is required. For TR7's connection to the Backend Services, the Backend SSL Security Profile, and for the management interface, the Min. TLS Version field on the Management Access screen are set separately.

Problem: Old TLS Versions Appear Enabled in Security Scans

TLS 1.0 and 1.1 have been deprecated with RFC 8996 and are not accepted in standards such as PCI DSS; security scans and SSL Labs lower the grade while these versions are enabled. The old versions need to be disabled, leaving TLS 1.2 and 1.3.

Solution: Four Methods

The methods apply to different connections; for the TLS that the vService presents to clients, Method 1 or 2 is used, and the others are applied separately when needed.

Your situation	Suitable method
The TLS versions that the vService presents to clients	Method 1: TLS Security Profile
The same setting from the command line	Method 2: WEB-CLI
The TLS connection that TR7 sets up to the Backend Services	Method 3: Backend SSL Security Profile
The HTTPS connection of the TR7 management interface	Method 4: Management Access

Method 1: TLS Security Profile Recommended

• How it works The lowest version in the profile is applied to the encrypted frontend rows of the vService; a client that tries to connect with an older version is rejected in the handshake. While the upper limit is off, TLS 1.3 is also accepted.
• Where it is openedCertificates & PKI → TLS Security Profiles · vService → Details → Frontend Settings → SSL Security
• Requirement An encrypted frontend (Encrypted (HTTPS) or TCP + TLS) and a certificate on the vService
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → TLS Security Profiles screen, Add is clicked (how to add). If a custom profile is already selected on the vService, that profile is selected and Edit is clicked. The new profile form opens filled in with the Default Profile values.

2

Adım 2 Enter the name

The Security Profile Name is entered; the name must be unique on the device.

3

Adım 3 Set the version range

In the TLS Settings (Frontend & Backend) section, Min. SSL Version comes on and is TLSv1.1; TLSv1.2 is selected. Max. SSL Version is off by default and no upper limit is applied, which means TLS 1.3 is also accepted; if it is turned on, TLSv1.3 comes selected. If only TLS 1.3 is wanted, Min. SSL Version = TLSv1.3 is selected. If the upper limit is selected below the lower limit, the form gives the Max SSL version cannot be lower than min SSL version error.

4

Adım 4 Save the profile

The Add button at the bottom of the form is clicked (Edit if an existing profile is being edited). If an existing profile was changed, the configuration is reapplied to all the vServices that use it.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

6

Adım 6 Select the profile

In the Details panel, the SSL Security box under Frontend Settings is checked; in the selector that opens, the profile from step 4 is selected instead of Default Profile (profile selection on the vService). The box is listed only while an encrypted protocol is selected in at least one frontend row.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Old versionClient side

A connection is made to the same address with three versions.

Command: openssl s_client -connect 203.0.113.10:443 -servername www.example.com -tls1_1 (then -tls1_2 and -tls1_3)

ExpectedTLS 1.1 is rejected in the handshake · 1.2 and 1.3 connect

The client's OpenSSL version may have disabled TLS 1.1 itself; that the rejection comes from the server is also verified with sslscan.

2Supported versionsTR7 side

sslscan is run in the TR7 WEB-CLI.

Command: sys-cmd sslscan --sni-name=www.example.com 203.0.113.10:443

ExpectedTLSv1.0 disabled · TLSv1.1 disabled · TLSv1.2 enabled · TLSv1.3 enabled

Method 2: WEB-CLI

• How it works The profile and the vService assignment are made from the command line. A profile created with WEB-CLI is not filled in with the Default Profile values as in the interface: if Cipher Algorithms is not written, the weak Hardware Supported set, which is the first set in the list, is saved, and Restart Undefined TLS Requests comes off.
• Where it is opened TR7 WEB-CLI → lb ssl-security add · lb service update
• Requirement WEB-CLI access; an encrypted frontend on the vService
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Create the profile

The lowest version and the cipher set are written explicitly (version and cipher fields):

lb ssl-security add name tls12plus --minSslVersion TLSv1.2 --cipherAlgorithm general --noTlsTickets true

2

Adım 2 Assign the profile to the vService

--sslSecurity replaces the profile of the vService with this profile; it also turns on the SSL Security module on the vService:

lb service update id <vService> --sslSecurity tls12plus

Verification

1Record and versionsTR7 side

The profile is displayed; then the sslscan check in Method 1 is performed.

Command: lb ssl-security list

Expectedtls12plus in the list

Method 3: Backend SSL Security Profile

• How it works The version range and the cipher list to be used in the TLS connection that TR7 sets up to the Backend Service are limited with a profile; only the TLS Settings (Frontend & Backend) section of the profile is applied.
• Where it is openedLoad Balancer → Backend Services → Edit → SSL Service → Backend SSL Security Profile
• RequirementSSL Service on in the Backend Service (the server listens on TLS)
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Prepare the profile (if needed)

If there is no profile with the desired version range, it is created with steps 1–4 of Method 1.

2

Adım 2 Open the Backend Service edit form

On the Load Balancer → Backend Services screen, the Backend Service is selected and Edit is clicked. SSL Service must be on; only then do the TLS fields appear.

3

Adım 3 Select the profile

The profile is selected in the Backend SSL Security Profile field (default None). This field has no Default Profile option.

4

Adım 4 Save

The Edit button at the bottom of the form is clicked; the server connection of all the vServices that use the Backend Service is set up with this profile.

The WEB-CLI equivalent; since the command also keeps SSL Service on, it is used only on servers that listen on TLS:

lb backend update id <id> --sslService true --sslSecurityProfile tls12plus

Verification

1Server connectionTR7 side

The health status of the Backend Service is checked in the Load Balancer → Backend Services list; if the server does not support TLS 1.2, the connection cannot be set up.

ExpectedBackend Service healthy, vService traffic flowing

Method 4: Management Access

• How it works The HTTPS versions of the TR7 management interface are set independently of the vService profiles; by default, there is no version restriction.
• Where it is openedSettings → Device Management → Management Access → Edit → HTTPS
• Requirement An Admin (Super Admin) user; at least one IP defined in HTTPS access
• Scope Management interface

Step-by-Step Configuration

1

Adım 1 Open the edit tab

On the Settings → Device Management → Management Access screen, Edit is clicked.

2

Adım 2 Select the version

In the Min. TLS Version field in the HTTPS section, TLSv1.2 is selected (default Disabled (default)); if Max. TLS Version is left at Disabled (default), TLS 1.3 is also accepted.

3

Adım 3 Save

The Edit button at the very bottom of the form is clicked.

Verification

1Management interfaceClient side

An attempt is made to connect to the management address with TLS 1.1.

Command: openssl s_client -connect 192.0.2.5:443 -tls1_1

ExpectedTLS 1.1 is rejected

Common Mistakes

• Leaving SSL Security on the Default Profile. The Default Profile allows TLS 1.1 and cannot be edited; the old versions are disabled only with a new profile.
• Never checking the SSL Security box. While the box is off, no profile is applied to the vService and the version range remains at the defaults of the engine.
• Selecting the TLS v1.3 Compatible cipher set for TLS 1.3 only. The version restriction is made not with the cipher set but with Min. SSL Version = TLSv1.3; the cipher list determines the suites of TLS 1.2 and earlier versions, and the TLS 1.3 suites are the defaults of the engine.
• Not writing the cipher set in WEB-CLI. In a profile created with WEB-CLI, if --cipherAlgorithm is not written, the weak Hardware Supported set is saved; the set is written explicitly.
• Thinking that the management interface has also changed. vService profiles do not affect the management interface; Management Access is set separately.

How it is done in the documentation

• TLS Security Profiles · Min. SSL Version
• TLS Security Profiles · The Profile Selection in the vService
• Backend Services · Backend SSL Security Profile
• WEB-CLI · lb ssl-security · The Version and Cipher Fields

Related questions

• What is a TLS Security Profile, and what does it configure?
• How do I disable weak ciphers?
• What should I do to get an A+ from SSL Labs?
• How do I test from TR7 which TLS versions and ciphers a server supports?