TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache

Databáze řešení

TLS (Transport Layer Security) is the protocol underlying HTTPS. Understanding the difference between TLS 1.2 and TLS 1.3 — and configuring your server to use modern versions correctly — matters for both security and performance.

What Changed in TLS 1.3

Faster handshake — TLS 1.3 reduces the connection handshake to one round-trip (down from two in TLS 1.2), meaning slightly faster initial page loads
Removed weak/legacy cryptographic algorithms — TLS 1.3 eliminates outdated ciphers that were still technically allowed (though often unused) in TLS 1.2
Improved forward secrecy — TLS 1.3 mandates forward secrecy for all connections, protecting past sessions even if a server's private key is later compromised

Should You Disable TLS 1.2?

Generally, no — TLS 1.2 remains secure when properly configured (strong cipher suites, no legacy algorithms) and is still required for compatibility with some older clients. The recommended approach is supporting both TLS 1.2 and 1.3, while disabling anything older (TLS 1.0, TLS 1.1, and SSL entirely).

Checking Your Current TLS Configuration

echo | openssl s_client -connect yourdomain.com:443 -tls1_2
echo | openssl s_client -connect yourdomain.com:443 -tls1_3

A successful connection on both commands confirms your server supports both versions.

Configuring Nginx for TLS 1.2 and 1.3 Only

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
}

ssl_prefer_server_ciphers off is recommended for TLS 1.3, since modern clients generally choose secure ciphers reliably on their own.

Configuring Apache for TLS 1.2 and 1.3 Only

<VirtualHost *:443>
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder off
</VirtualHost>

Verifying Legacy Protocols Are Disabled

echo | openssl s_client -connect yourdomain.com:443 -tls1
echo | openssl s_client -connect yourdomain.com:443 -tls1_1

Both of these should fail to connect if legacy protocols are correctly disabled.

Testing with an Online SSL Analyzer

A dedicated SSL testing tool (search for "SSL Labs test" or similar) gives a comprehensive grade and breakdown of your protocol/cipher configuration — useful for confirming the full picture beyond individual command-line checks.

Performance Impact of TLS 1.3

The reduced handshake overhead in TLS 1.3 is particularly noticeable on higher-latency connections (mobile networks, geographically distant visitors) — a meaningful, if modest, real-world performance improvement alongside the security benefits.

Common Errors

Some older clients can't connect after disabling TLS 1.0/1.1 — expected and generally acceptable; these protocols are deprecated for security reasons, and the remaining incompatible client share is typically very small and itself a security risk to accommodate.

"ssl_protocols" directive not taking effect — verify there isn't a conflicting or duplicate ssl_protocols directive elsewhere in your Nginx configuration (e.g. in the default server block) overriding your intended setting.

FAQ

Is TLS 1.3 supported by all modern browsers?
Yes — all current major browsers (Chrome, Firefox, Safari, Edge) support TLS 1.3; compatibility is not a practical concern for modern visitors.

Continue Reading

Browse more articles in SSL/TLS & Certificates.

Databáze řešení

Kategorie

Kategorie