Browsers will disable tls 1.1 in 2020 – update

Browser builders will disable tls 1.0 and 1.1 in early 2020. This has been announced by Microsoft, Apple and Google. By announcing this early, the companies hope that site owners will have enough time to switch to tls 1.2 and 1.3.

Microsoft says it is not aware of any exploits in tls 1.0 and 1.1, but that there are vulnerabilities with third-party implementations. That necessitates the elimination of the old web standards for site security, according to the company. In addition, standards organization Internet Engineering Task Force wants to end support for tls 1.1, so that no more measures will be taken if exploits are found.

According to Microsoft, the move should cause few problems. About 94 percent of the world’s best-known sites support tls 1.2 or higher, and 0.72 percent of all sessions currently happen in Edge via tls 1.0 or 1.1, the browser maker says. Sites that aren’t over yet should do so soon. Tls stands for transport layer security and is a standard for the encryption of web traffic. The first version of tls dates from about twenty years ago.

Update, 21:23: This article was initially only about Edge and Internet Explorer, but it turns out that other browser builders are also phasing out tls 1.0 and 1.1, including Apple and Google. Mozilla would also do that in Firefox, but that blog post does not appear online yet.