Disable unsecure SSL versions

The encryption protocols Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) secure communication on the Internet. Because not all browsers support the TLS protocols, the use of older protocols is often still allowed. Internet Explorer 6, for example, did not support TLS. SSL version 1 and 2, SSLv2 and SSLv3 are now insecure. It is also recommended to phase out TLS 1.0 and TLS 1.1. We recommend that you disable SSLv2, SSLv3, TLS 1.0 and TLS 1.1 in your server configuration so that only the newer TLS protocols can be used. It is recommended to only enable TLS 1.3 for maximum security. Your server and visitors need to support TLS 1.3 for that.

SSLv2

SSL version 2 has not been standard since 1995. While it is still supported by a number of legacy products, it is usually disabled. The TLS protocol has since succeeded SSL. If SSLv2 is still in use, it is strongly recommended to replace it with a newer security protocol, as SSLv2 has some serious shortcomings.

The main reasons for the insecurity of SSLv2 are:

• The algorithm used is too weak: SSLv2 message authentication uses MD5, which is too easy to crack.
• The handshake is not protected, so there is no protection against a so-called 'Man-In-The-Middle' attack.
• The same key is used for both authentication and encryption.
• There is no protection against unwanted closing of TCP connections by third parties (because of the TCP FIN command).

SSLv3

A leak was discovered in the SSLv3 encryption protocol in 2014, also referred as the POODLE bug. Despite the fact that this version is more than 15 years old, the protocol is still supported by many browsers and servers. The vulnerability allows hackers to intercept and read traffic. To prevent this, you can disable the use of SSL 3.0 on your server and in your browser.

TLS 1.0

TLS 1.0 is considered insecure because it uses outdated algorithms and functions, such as SHA-1 and MD5. Support for more modern techniques such as perfect forward secrecy is also lacking. As of early 2020, TLS 1.0 will no longer be supported by all major browsers - Apple, Google, Mozilla, Microsoft

TLS 1.1

TLS 1.1 is considered insecure because it uses outdated algorithms and functions, such as SHA-1 and MD5. Support for more modern techniques such as perfect forward secrecy is also lacking. As of early 2020, TLS 1.1 will no longer be supported by all major browsers - Apple, Google, Mozilla, Microsoft

TLS 1.2

TLS 1.2. is currently the standard, although the use of the latest TLS version 1.3 is encouraged. TLS 1.2 was published in August 2008 and is now widely used.

TLS 1.3

After a message from the National Cyber Security Center, the guidelines are to steps on TLS 1.3 also adjusted. It is recommended to phase out the other TLS versions on the servers.

Uitschakelen onveilige SSL versies

• Onveilige SSL versies uitschakelen in IIS
• Onveilige SSL versies uitschakelen in Apache
• Onveilige SSL versies uitschakelen in Nginx