Currently, my webserver support
One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1 now? Or I need to wait till this client move to TLS 1.2, then only we can remove it. What will be the advantage for us to remove TLS 1.0 and TLS 1.1? And what will be the drawback if we don't remove TLS 1.0 and TLS 1.1?
Also how I know my other single sign-on clients still need TLS 1.0 and TLS 1.1?
Thanks
To answer your first question: If you have clients that do not support TLS 1.2, and these clients connect to your server using TLS 1.0 or TLS 1.1, and you disable TLS 1.0 and TLS 1.1 on your server, then these clients will not be able to connect to your server.
With regard to the pro's and con's of continuing to support TLS 1.0 and TLS 1.1: Many organizations have disabled (or will soon disable) TLS 1.0 and TLS 1.1, because of known vulnerabilities in these versions of TLS. See this article for more information on these vulnerabilities. Disabling TLS 1.0 and TLS 1.1 on your server will protect your server and your clients from these vulnerabilities. However, if you have clients that support TLS 1.0 and/or TLS 1.1, but not TLS 1.2, then these clients will not be able to connect to your server if you disable TLS 1.0 and TLS 1.1.
Having said that, all mainstream web browsers have supported TLS 1.2 for quite some time now, so disabling TLS 1.0 and TLS 1.1 will probably affect very few of your users, if most of your users connect to your site with a recent version of a mainstream web browser.
For what it's worth, StackExchange recently disabled TLS 1.0 and TLS 1.1. for all of their sites, and posted a very informative write-up of the process here. Interestingly, they found that less than 1% of the TLS connections to their servers used TLS 1.0 and TLS 1.1 (and they suspect that most of these connections were from bots).
With regard to your final question about determining how many of your clients are still connecting to your server using TLS 1.0 and TLS 1.1, most web servers have the ability to log the TLS version that was used for each request from a client. Check the documentation for your web server to see how to enable this.
Related: What will happen to older browsers if I disable SSLv3 on my webserver?
My recommendation is to enable TLS 1.3, and then have a close look at what browsers does not support TLS 1.2 or TLS 1.3. If you can, just disable TLS 1.0 and 1.1, and use 1.2 and 1.3 going forward.
Also keep in mind that you also need to be rather selective on what cipher suites you can use, as a lot of them aren't secure at all. But this is a completely different kettle of fish, so I won't go into it further, but suffice to say, TLS protocol version isn't the only thing you need to worry about.
Looking at some online resources, you're going to have issues with the following browser/OS combinations if you choose to disable TLS 1.0 and 1.1:
As you can see, these are quite ancient browsers and OSes, so I wouldn't worry too much if you're just serving the Internet in general. Inhouse this might be a bit different, I've heard horror stories of some organisations not switching to TLS 1.2 and 1.3 because some inhouse application that requires IE8 or something).
You can analyse the statistics regarding protocol using as described here, for example.
Based on your analysis you can either disable deprecated TLS protocols immediately , or notify your clients in advance
