TLS 1.1 (Transport Layer Security 1.1)

TLS 1.1 is the second version of TLS, published in April 2006 as RFC 4346. Its main changes were security fixes for CBC ciphers: each record now carries an explicit initialization vector instead of reusing the last ciphertext block of the previous record, and padding errors are reported with the same alert as MAC failures to make padding-oracle attacks harder.

Why it matters

TLS 1.1 was never widely deployed on its own, because TLS 1.2 followed only two years later with SHA-256 based key derivation and AEAD cipher suites. TLS 1.1 still uses the MD5/SHA-1 based PRF of TLS 1.0 and supports only CBC and stream ciphers. Browsers removed it at the same time as TLS 1.0 (Chrome 84, Edge 84, Firefox 78, all mid-2020), and RFC 8996 deprecated both versions in March 2021. In practice, the minimum version for a public HTTPS site today is TLS 1.2.

Example

List the protocol versions and cipher suites a server accepts with nmap's standard script:

nmap --script ssl-enum-ciphers -p 443 example.com

A modern result shows only TLSv1.2 and TLSv1.3 sections. To remove TLS 1.1 in nginx:

ssl_protocols TLSv1.2 TLSv1.3;

Common misconceptions

• "TLS 1.1 is a reasonable middle ground." It was deprecated together with TLS 1.0 and removed from browsers at the same time. There is no client population that needs 1.1 but cannot do 1.2 that is worth weakening a server for.
• "Explicit IVs made CBC safe." They stopped the predictable-IV attack later demonstrated as BEAST, but MAC-then-encrypt CBC remained vulnerable to timing attacks such as Lucky Thirteen.
• "Turning off TLS 1.1 requires a new certificate." Protocol versions are server configuration; the existing certificate keeps working unchanged.