SSLVersionMax

Set and lock the maximum version of TLS. Firefox defaults to a maximum of TLS 1.3, meaning this policy can ensure users or other configuration mechanisms can't lower it.

For setting and locking the minimum version of TLS, see the SSLVersionMin policy.

Caution

TLS 1.0 and TLS 1.1 are deprecated. It's not recommended to set a maximum of tls1 or tls1.1, which stops Firefox from using TLS 1.2 and above.

Values

SSLVersionMax expects one of the following values:

• tls1: TLS 1.0
• tls1.1: TLS 1.1
• tls1.2: TLS 1.2
• tls1.3: TLS 1.3

Examples

policies.json

{
  "policies": {
    "SSLVersionMax": "tls1.3"
  }
}

JSON schema

SSLVersionMax JSON schema

{
  "type": "string",
  "oneOf": [
    {
      "const": "tls1",
      "title": "TLS 1.0"
    },
    {
      "const": "tls1.1",
      "title": "TLS 1.1"
    },
    {
      "const": "tls1.2",
      "title": "TLS 1.2"
    },
    {
      "const": "tls1.3",
      "title": "TLS 1.3"
    }
  ]
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"

macOS

<dict>
  <key>SSLVersionMax</key>
  <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
</dict>

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 6666	Available since 60.660.6	Available since 149149

CCK2 Equivalent: N/A
OMA-URI: SSLVersionMax
Preferences Affected: security.tls.version.max