Since version 7.34.0, Curl has options -tlsv1.0, -tlsv1.1 and -tlsv1.2 for this purpose. Version 7.52.0 introduced -tlsv1.3 in addition to the other options listed below. To specify an exact version to be used you likely have to also specify a value for -tls-max curl -tlsv1.2 -tls-max 1.2. Options like -tlsv1.2 now specify a minimum version that is to be used, they no longer specify the exact version to be used. Since version 7.54.0 the behaviour has changed, see nelsonda's answer.

There have been several relevant changes in Curl since the original question was asked. At the date of the last revision to this answer, if you want to specify that TLS 1.2 is used but not 1.1 or 1.3 etc, you need something like curl -tlsv1.2 -tls-max 1.2. It is not recommended to set the minimum TLS to 1.3, unless there is a specific use case, as this will likely cause issues with search engine crawlers and certain browsers.Curl has options to control the TLS version used. However, you also need to ensure that your users upgrade to a TLS 1.2 compliant browser. These sites might already have more stringent security requirements or might be subject to PCI compliance. In this way, you minimize the possibility that some clients cannot connect to your site securely.įor a narrow user base and sites that run internal applications or business and productivity applications, Cloudflare recommends TLS 1.2. Depending on your particular business situation, this may present some limitations in using stronger encryption standards.Ĭonsider using TLS 1.0 or 1.1 for sites with a broad user base, particularly non-transactional sites.

Not all browser versions support TLS 1.2 and above. TLS 1.3, which offers additional security and performance improvements, was approved by the Internet Engineering Task Force (IETF) in May 2018. Cloudflare recommends migrating to TLS 1.2 to comply with the PCI requirement. TLS 1.2 includes fixes for known vulnerabilities found in previous versions.Īs of June 2018, TLS 1.2 is the version required by the Payment Card Industry (PCI) Security Standards Council. Understand TLS versionsĪ higher TLS version implies a stronger cryptographic standard. * error:1400442E:SSL routines:CONNECT_CR_SRVR_HELLO:tlsv1 alertįor guidance on which TLS version to use, review the information outlined below. If the TLS version you are testing is blocked by Cloudflare, the TLS handshake is not completed and returns an error:

Openssl test tls 1.2 with cert