---
title: "WEB-APA-005 Apache Allows TLS 1.0 or 1.1"
canonical: https://openvapt.com/checks/WEB-APA-005.html
html: https://openvapt.com/checks/WEB-APA-005.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APA-005 Apache Allows TLS 1.0 or 1.1

SSLProtocol permits SSLv3, TLSv1 or TLSv1.1, or is not set on a TLS-enabled server (the default  all -SSLv3  allows TLS 1.0 and 1.1).

- Domain: Web Apps
- Severity: High
- Control category: Cryptography and TLS
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`
- CIS Controls v8: 3.10
- NIST CSF 2.0: PR.DS-02
- CWE: CWE-326, CWE-327
- OWASP Top 10 2021: A02:2021
- OWASP ASVS 4.0.3: 9.1.3
- OWASP WSTG v4.2: WSTG-CRYP-01
- NIST SP 800-53 Rev. 5: SC-8, SC-13
- Benchmark topic: TLS protocol versions (topic only, no benchmark text)

## Why It Matters

TLS 1.0 and 1.1 are deprecated by RFC 8996 and lack the protections of TLS 1.2 and 1.3. Apache's default still allows them, so an explicit SSLProtocol is required. The directive is not the last word: mod_ssl uses the system OpenSSL, and when its configuration already sets a floor of TLS 1.2 (MinProtocol in openssl.cnf on Debian 12 and Ubuntu 22.04 and later, or a crypto policy of DEFAULT, FUTURE or FIPS on the RHEL family) the old versions cannot be negotiated whatever the directive lists. In that case the check reports Pass and names the floor, because rating a server High for a line that has no effect would contradict the live handshake checks (WEB-TLS). The directive is still worth tidying so the configuration says what it does.

## How It Detects

Reads every SSLProtocol directive and expands  all , + and - tokens. Any resulting version below TLSv1.2 fails, as does an absent SSLProtocol when SSLEngine on or SSLCertificateFile is present, unless /etc/crypto-policies/config or openssl.cnf (with its .include files) shows the system library already refuses TLS 1.0 and 1.1, in which case the result is Pass with the floor as evidence.

## How to Fix

Set  SSLProtocol -all +TLSv1.2 +TLSv1.3  (Mozilla intermediate) in mods-enabled/ssl.conf or ssl.conf, then apachectl configtest and reload.

## How to Verify

```
openssl s_client -connect 127.0.0.1:443 -servername <site> -tls1_1  should fail to connect.
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)

## References

- [Apache HTTP Server, SSLProtocol directive](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol)
- [Mozilla, Server Side TLS guidelines](https://wiki.mozilla.org/Security/Server_Side_TLS)
- [NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations](https://csrc.nist.gov/pubs/sp/800/52/r2/final)
- [OpenSSL, config(5): system default TLS settings (MinProtocol)](https://docs.openssl.org/3.0/man5/config/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-APA-005`. Read it offline: `openvapt explain WEB-APA-005`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APA-005.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.