The quickest way to see the TLS version a website uses is our SSL Certificate Checker, which shows the negotiated protocol and cipher next to the certificate details. In Chrome, open DevTools (F12) → Security to see the connection protocol. To find out which older versions a server still accepts, test each version with OpenSSL or scan the server with nmap. A modern site should offer TLS 1.3 and TLS 1.2 only.
TLS versions at a glance
| Version | Year | Status |
|---|---|---|
| SSL 2.0 / 3.0 | 1995 / 1996 | Broken; must be disabled |
| TLS 1.0 | 1999 | Deprecated by RFC 8996 (2021); disable |
| TLS 1.1 | 2006 | Deprecated by RFC 8996 (2021); disable |
| TLS 1.2 | 2008 | Still widely used and secure with modern cipher suites |
| TLS 1.3 | 2018 | Current version: faster handshake, only strong ciphers |
In the browser
- Chrome and Edge: press F12, open the Security tab (it may be under the
»menu) and reload. The Connection section shows, for example, “TLS 1.3, X25519, AES_128_GCM”. - Firefox: click the padlock → Connection secure → More information. The Technical Details line shows the protocol and cipher.
The browser shows only the version it negotiated, normally the newest one both sides support. It does not tell you whether the server still accepts TLS 1.0 from an old client.
With OpenSSL: test each version
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/nullA successful handshake prints the certificate and a line such as Protocol : TLSv1.2; a refused version ends with an error like no protocols available or alert protocol version. Recent OpenSSL builds may have TLS 1.0/1.1 disabled on the client side, so a failure there is not always proof the server refuses it.
With curl
curl -sv https://example.com -o /dev/null 2>&1 | grep -i "SSL connection"
curl -sv --tlsv1.2 --tls-max 1.2 https://example.com -o /dev/nullThe first command shows the negotiated version, for example SSL connection using TLSv1.3. The second forces TLS 1.2 to check that the server still supports it for older clients.
With nmap: list every supported version
nmap --script ssl-enum-ciphers -p 443 example.comThe script lists every protocol version and cipher the server accepts and grades them. Only scan servers you own or are authorized to test.
Fixing an outdated configuration
- Nginx:
ssl_protocols TLSv1.2 TLSv1.3; - Apache:
SSLProtocol -all +TLSv1.2 +TLSv1.3 - IIS / Windows Server: TLS versions are controlled in the registry under
SCHANNEL\Protocols; tools such as IIS Crypto make the change safer. A restart is required. - Behind a CDN: the CDN negotiates TLS with visitors; set the minimum version in its dashboard and secure the CDN-to-origin connection separately.
After changing the configuration, re-test from outside with the SSL checker. The handshake itself is explained in TLS handshake explained.
Common Questions
Is TLS 1.2 still secure?
Yes, when it is used with modern cipher suites (ECDHE key exchange and AES-GCM or ChaCha20). Keep TLS 1.2 enabled alongside TLS 1.3 for compatibility with older clients.
Why does my browser show TLS 1.3 but a scanner reports TLS 1.0?
The browser shows only the newest version both sides agreed on. A scanner tests every version, so it reveals old versions the server still accepts. Those should be disabled.
Does disabling TLS 1.0 and 1.1 break anything?
Only very old clients, such as Android 4.3 and earlier or Internet Explorer on old Windows versions. All current browsers have supported TLS 1.2 for years.
Where do I set the TLS version for a site behind Cloudflare?
In the Cloudflare dashboard under SSL/TLS, set the minimum TLS version for visitors. The connection between Cloudflare and your server is configured on your server.