How to Enforce TLS 1.2 and 1.3 in Magento 2

Magento 2 stores should accept only TLS 1.2 and TLS 1.3, because support for TLSv1.1 was deprecated in March 2020 and older versions expose the store to downgrade attacks such as POODLE. In Nginx, set ssl_protocols TLSv1.2 TLSv1.3;. If the site sits behind a firewall like Cloudflare or AWS WAF, switch the minimum TLS version there instead. Verify the result with the SSL Labs server test.

Check server connection security

Verify your website against SSL vulnerabilities here. Remember to mark the checkbox: Do not show the results on the boards.

If your scan results are not green, continue reading to learn how to secure your Magento 2 store.

Understand the issue

With enough effort and time, you can break into every vault. We may safeguard valuable data only by preventing access to it.

Establishing connection from client to the web server relies on agreement between machines. They decide how to transfer data that’s understandable for both of them.

Various hardware and software vendors adopt modern security standards at their own pace. Permissive configurations can handle more clients, but at risk of the overall security. That’s the price of backward compatibility.

For SSL vulnerabilities, the attacker is trying to downgrade connection security version. Communication with lower-quality mode is an open door for security breaches.

When you allow the server to use older SSL/TLS versions, you’re introducing possible vulnerabilities to be exploited.

In other words, if your Magento 2 store allows outdated SSL/TLS versions, hackers can exploit vulnerabilities like POODLE to steal sensitive customer data. This could lead to financial loss and cause damage to your store’s reputation.

Only TLSv1.3 is immune to POODLE and LOGJAM attacks, but not all clients support TLSv1.3. If you care about customers with older browsers and devices, stick with version 1.2 using strong ciphering (at least 768 or 1024, depending on the algorithm).

Watch this video for a quick explanation of why upgrading to TLS 1.2 and 1.3 is crucial for your Magento 2 store’s security:

Enforce minimal version in Nginx

In the listen section of Nginx config, replace ssl_protocols line with:

ssl_protocols TLSv1.2 TLSv1.3;

That should be enough to mitigate most issues related to older SSL/TLS versions.

If your website is behind a firewall, e.g. Cloudflare, AWS WAF, there is a simple switch that lets you apply the desired TLS version. Just refer to the relevant documentation.

Benefits of Using TLS 1.2 & 1.3

The most recent versions of TLS improve both security and performance of your website. Elliptic curve algorithms available for TLSv1.2 are much faster than RSA. Optimizations reduce the amount of resources spent by the server on encryption. This decreases website response latency, resulting in better user experience.

Need help securing your Magento 2 store? Get expert assistance today!

Frequently asked questions

SSL/TLS security in Magento 2

Which TLS versions should a Magento 2 store support?

A Magento 2 store should accept only TLS 1.2 and TLS 1.3. Support for TLSv1.1 was deprecated in March 2020. Only TLS 1.3 is immune to POODLE and LOGJAM attacks, but not all clients support it, so keep TLS 1.2 with strong ciphers for customers on older browsers and devices.

How do I disable TLS 1.0 and TLS 1.1 in Nginx?

Replace the `ssl_protocols` line in the Nginx server config with `ssl_protocols TLSv1.2 TLSv1.3;`. This stops the server from negotiating older SSL/TLS versions and mitigates most issues related to them.

How can I check if my website uses outdated SSL/TLS?

Run your domain through the SSL Labs server test at ssllabs.com/ssltest. Tick the "Do not show the results on the boards" checkbox so the result stays private. Any result that is not green points to a configuration that needs fixing.

How does a POODLE attack affect an eCommerce store?

In an SSL downgrade attack such as POODLE, the attacker forces the connection to an older, weaker SSL/TLS version and exploits its vulnerabilities. A Magento 2 store that still allows outdated versions lets attackers steal sensitive customer data, which can lead to financial loss and damage to the store's reputation.

How do I enforce TLS 1.2 when my site is behind Cloudflare or AWS WAF?

Firewalls such as Cloudflare and AWS WAF have a setting that applies the minimum TLS version for all traffic. Set it to TLS 1.2 following the provider's documentation.

Is TLS 1.2 or 1.3 faster than older TLS versions?

Recent TLS versions improve both security and performance. Elliptic curve algorithms available for TLS 1.2 are much faster than RSA, so the server spends fewer resources on encryption. That lowers response latency for shoppers.