SSLVersionMin

Set and lock the minimum version of TLS. Firefox defaults to a minimum of TLS 1.2, meaning this policy can ensure users or other configuration mechanisms can't lower it.

For setting and locking the maximum version of TLS, see the SSLVersionMax policy.

Caution

TLS 1.0 and TLS 1.1 are deprecated, meaning it's not recommended to enable anything lower than TLS 1.2. Setting a minimum of tls1 or tls1.1 re-enables them for every site, and the cipher suites those versions rely on may also need to be turned back on with the security.tls.version.enable-deprecated preference.

Values

SSLVersionMin expects one of the following values:

• tls1: TLS 1.0
• tls1.1: TLS 1.1
• tls1.2: TLS 1.2
• tls1.3: TLS 1.3

Examples

policies.json

{
  "policies": {
    "SSLVersionMin": "tls1.2"
  }
}

JSON schema

SSLVersionMin JSON schema

{
  "type": "string",
  "oneOf": [
    {
      "const": "tls1",
      "title": "TLS 1.0"
    },
    {
      "const": "tls1.1",
      "title": "TLS 1.1"
    },
    {
      "const": "tls1.2",
      "title": "TLS 1.2"
    },
    {
      "const": "tls1.3",
      "title": "TLS 1.3"
    }
  ]
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"

macOS

<dict>
  <key>SSLVersionMin</key>
  <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
</dict>

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 6666	Available since 60.660.6	Available since 149149

CCK2 Equivalent: N/A
OMA-URI: SSLVersionMin
Preferences Affected: security.tls.version.min