We are considering disabling TLS1.0 and TLS1.1 in the policies for a browser used organization-wide. We already have a primary browser, where >=TLS1.0 is enabled (i.e. SSLv3 is disabled). We do not know if any sites the user uses, uses

Best practice is to use TLS1.2 and additionally disable RC4- and 3DES-ciphers. It only refers to web server configuration of the SSL/TLS-cihper suites and not really to the client side.

What are the benefits and disadvantages of disabling support for TLS1.0/TLS1.1 client side? How is the user further secured? Could an attacker e.g. force use of a 3DES-TLS1.0-cipher (if the user visits a page using this) or does an attack like that only make the web server vulnerable?

  • I found this question which is somewhat related, but the discussion turns into problems for the servers. I'm interested in what benefits in terms of security the users might achieve. Commented Aug 16, 2017 at 11:13

1 Answer 1


The big disadvantage to users in this case would be that they could no longer access sites which don't support TLSv1.2. Data on those sites is fairly hard to find (I found a survey from 2014, which found about 1/3 sites supported TLSv1.2, but that's ancient in web terms), so this might be a huge problem, or might be a non-issue, depending on what your staff need to access.

Some of the known issues with earlier TLS versions are actually implementation issues with servers which support them. For those, there isn't any direct client benefit to disabling the protocols.

In terms of avoiding the use of 3DES and other weak ciphers, that's a separate issue - you can use 3DES with TLSv1.2, although there is usually very little call to do so, since a system with support for TLSv1.2 will support stronger ciphers. I'm not aware of a reliable method to reject the use of specific ciphers from the client side.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .