Bug#943415: apache2: Disable TLS 1.0 and 1.1 by default

Vincent Lefevre <[email protected]> Thu, 17 Jul 2025 01:23:30 +0200

Newsgroups	gmane.linux.debian.devel.apache
Message-ID	<20250716232330.GA179261__37241.8894128472$1752708574$gmane$org@qaa.vinc17.org>

Control: found -1 2.4.63-1
Control: found -1 2.4.64-1
Control: tags -1 security

On 2023-11-15 13:32:32 +0100, David PrÃ©vot wrote:
> Le Thu, Oct 24, 2019 at 05:50:50PM +0200, Kurt Roeckx a Ã©crit :
> > I was expecting TLS 1.0 and 1.1 to be disabled
> 
> Same here. Four years later, RFC 8996 (Deprecating TLS 1.0 and TLS 1.1)
> has been published and most clients have been updated, so could we
> please review the default SSLProtocol before Trixie gets released? 

I'm also wondering why they are still enabled by default...