ERR_SSL_OBSOLETE_VERSION: Fix

• nginx older than 1.13 cannot do TLS 1.3 (1.2 yes)
• Apache without a current mod_ssl is stuck at TLS 1.0/1.1
• OpenSSL < 1.0.1 cannot do TLS 1.2
• Router/firewall with legacy SSL proxy
• IoT devices (cameras, printers) only TLS 1.0

1. nginx: ssl_protocols TLSv1.2 TLSv1.3; (do not include TLSv1 and TLSv1.1)
2. Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3
3. Update OpenSSL: apt update && apt upgrade openssl libssl-dev
4. Ensure nginx built with newer OpenSSL: nginx -V 2>&1 | grep -i ssl
5. Then: nginx -t && systemctl reload nginx

Check SSL Certificate →

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The ERR_SSL_OBSOLETE_VERSION error occurs when a web browser attempts to connect to a server using outdated TLS protocols, specifically TLS 1.0 or 1.1. To resolve this issue, ensure your server is configured to support TLS 1.2 or higher, as these versions are more secure and widely accepted by modern browsers. Check your server's SSL/TLS settings and update as necessary to avoid this error.

The ERR_SSL_OBSOLETE_VERSION error indicates that a client (usually a web browser) is trying to connect to a server that only supports outdated versions of the Transport Layer Security (TLS) protocol. TLS 1.0 and TLS 1.1 have been deemed insecure due to various vulnerabilities, including the POODLE attack and BEAST attack, which exploit weaknesses in these older protocols. As of June 30, 2020, major browsers such as Chrome, Firefox, and Edge have deprecated TLS 1.0 and TLS 1.1, meaning that any site relying on these protocols will be flagged as insecure.

For web administrators and developers, it is crucial to understand the implications of this error. When users encounter ERR_SSL_OBSOLETE_VERSION, they are unable to access your site, which can lead to decreased traffic and trust. Furthermore, many compliance standards, such as PCI DSS, require the use of secure protocols, making it essential for businesses to maintain up-to-date security practices.

To diagnose the issue, you can use tools like SSL Labs' SSL Test, which provides a detailed report on your server's SSL/TLS configuration. This can help identify which versions of TLS are supported and whether any cipher suites are outdated.

To resolve the ERR_SSL_OBSOLETE_VERSION error, follow these steps to reconfigure your server to support only secure TLS versions (1.2 and above):

1. Identify Your Server Type

Depending on your server, the configuration steps will vary:

• Apache: Locate and edit your SSL configuration file, typically found in /etc/httpd/conf.d/ssl.conf or /etc/apache2/sites-available/default-ssl.conf.
• Nginx: Edit your configuration file, usually located in /etc/nginx/nginx.conf or a site-specific configuration file in /etc/nginx/sites-available/.
• Microsoft IIS: Use the IIS Manager to configure SSL settings.

2. Update the TLS Version

In your server configuration, specify the supported TLS versions. Here’s an example configuration for both Apache and Nginx:

# Apache Configuration

SSLProtocol -all +TLSv1.2 +TLSv1.3

# Nginx Configuration

ssl_protocols TLSv1.2 TLSv1.3;

3. Disable Older Protocols

Ensure that TLS 1.0 and TLS 1.1 are explicitly disabled. This can be done by including the following lines in your configuration:

# Apache

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

# Nginx

ssl_protocols TLSv1.2 TLSv1.3;

4. Test Your Configuration

After making the changes, restart your web server:

# Apache

sudo systemctl restart apache2

# Nginx

sudo systemctl restart nginx

Finally, retest your configuration using the SSL Labs' SSL Test to ensure that your server is now compliant with modern security standards and no longer presents the ERR_SSL_OBSOLETE_VERSION error.