# Should we disable TLS 1.0 and 1.1?

Yes. Both have been formally deprecated by the IETF since RFC 8996 (March 2021), major browsers no longer accept them, and they rely on old hash functions and cipher constructions with known weaknesses. If they are still enabled on a server, the risk is less a direct attack than a downgrade path, and a sign of neglect that auditors, insurers and scanners will flag. Before switching them off, find out who still uses them: old printers, scanners, industrial devices, legacy applications and embedded clients are the usual suspects, and turning the protocols off without checking can stop a production line or a payment terminal. Look at server logs where they record the TLS version, run an external scanner against public services, and inside the network look at the TLS versions in the handshakes. Then disable them, or isolate what cannot be upgraded in its own segment with a plan to replace it. The same inventory will serve your post-quantum work later.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/should-we-disable-tls-1-0-and-1-1

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Which TLS ciphers should we turn off?](https://netsenx.com/en/faq/which-tls-ciphers-should-we-turn-off)
- [What is forward secrecy?](https://netsenx.com/en/faq/what-is-forward-secrecy)
- [What is encryption, in plain terms?](https://netsenx.com/en/faq/what-is-encryption-in-plain-terms)
- [What is the difference between symmetric and asymmetric encryption?](https://netsenx.com/en/faq/what-is-the-difference-between-symmetric-and-asymmetric-encryption)
- [How long should an encryption key be?](https://netsenx.com/en/faq/how-long-should-an-encryption-key-be)