TLS 1.2 vs TLS 1.3: Differences and How to Upgrade

TLS (Transport Layer Security) is the encryption protocol securing data between browsers and servers. TLS 1.2 has been the standard for over a decade, while TLS 1.3 (finalized in 2018) is significantly faster and more secure. This guide walks through the history of each version, compares speed and security, shows how to enable or disable each TLS version on real servers, and explains how to check which version your website is currently using.

History and Status of Each TLS Version

TLS evolved from SSL (Secure Sockets Layer) back in the 1990s. Today every SSL version (2.0 and 3.0) has been retired due to serious flaws such as POODLE, and TLS itself has gone through several releases. The table below summarizes the status of each version in 2026 — whether it should still be used or disabled entirely.

In short, for 2026 you should enable only TLS 1.2 and TLS 1.3. SSL 3.0, TLS 1.0 and TLS 1.1 must be disabled entirely, since modern browsers no longer support them and security standards like PCI DSS prohibit their use.

Key Differences: TLS 1.2 vs TLS 1.3

How TLS 1.3 Is Faster and More Secure (1-RTT, Forward Secrecy)

Three things make TLS 1.3 superior to earlier versions: a faster handshake, mandatory Forward Secrecy, and the removal of every weak cipher.

Faster Handshake with 1-RTT

In TLS 1.2, establishing a connection requires two round trips (2-RTT) between browser and server before any real data flows. TLS 1.3 cuts this to a single round trip (1-RTT), making pages load noticeably faster — especially for users far from the server or on mobile networks with high latency. The greater the distance, the more time each saved round trip recovers.

0-RTT for Returning Visitors

When a user has connected before and returns, TLS 1.3 supports 0-RTT resumption, sending data almost immediately without a fresh handshake. This makes sites feel much snappier for repeat visitors. Be cautious with replay attacks on state-changing requests (such as payments), so enable 0-RTT only for safe, idempotent requests.

Forward Secrecy Enforced Every Session

Forward Secrecy (PFS) means that even if the server's private key leaks in the future, attackers still cannot decrypt previously captured traffic, because each session uses its own ephemeral keys. In TLS 1.2 this was optional and depended on cipher configuration, but TLS 1.3 enforces it automatically on every session. It also trims the cipher suite list from 37 down to just 5 vetted, strong options — eliminating the risk of misconfiguration.

Enable/Disable TLS Versions on Nginx and Apache

The core of the configuration is enabling only TLS 1.2 and 1.3 while disabling TLS 1.0/1.1. Below are working configuration examples.

Nginx — Enable TLS 1.2 + 1.3, Disable the Rest

# Inside the server { ... } or http { ... } block
ssl_protocols TLSv1.2 TLSv1.3;   # Omitting TLSv1 / TLSv1.1 disables them
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;   # TLS 1.3 lets the client pick the cipher

Test the syntax first with sudo nginx -t, then reload sudo nginx -s reload

Apache — Explicitly Disable Old TLS

# Requires OpenSSL 1.1.1+ and Apache 2.4.37+ for TLS 1.3
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
SSLHonorCipherOrder off

Validate with sudo apachectl configtest, then reload sudo systemctl reload apache2 (or httpd on CentOS/RHEL)

How to Check Which TLS Version a Site Uses

Before and after tweaking your config, verify which TLS versions the server supports. There are several methods, from online tools to terminal commands.

Check Your Current TLS Version

Method 1: SSL Labs (Easiest)

Go to https://www.ssllabs.com/ssltest/, enter your domain, and check the TLS Protocols section.

Method 2: curl

curl -v --tlsv1.3 --tls-max 1.3 https://yourdomain.com 2>&1 | grep "TLS"

Method 3: OpenSSL

openssl s_client -connect yourdomain.com:443 -tls1_3 2>&1 | grep "Protocol"

Enable TLS 1.3 on Nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Then reload: sudo nginx -s reload

Enable TLS 1.3 on Apache

# Requires OpenSSL 1.1.1+ and Apache 2.4.37+
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

Should You Disable TLS 1.0 and 1.1?

Yes — IETF officially deprecated TLS 1.0 and 1.1 in 2021, and modern browsers have dropped support. Disabling them helps achieve A+ on SSL Labs and meet PCI DSS compliance.

Recommended Cipher Suites for TLS 1.2 and TLS 1.3

Choosing the right cipher suites is what separates a secure TLS 1.2 configuration from an outdated one. Below are the recommended ciphers and the ones you must remove from any server configuration.

Recommended Ciphers for TLS 1.2

• ECDHE-ECDSA-AES128-GCM-SHA256 — supports ECDSA certificates; fast and secure
• ECDHE-RSA-AES128-GCM-SHA256 — supports the widely used RSA certificates
• ECDHE-ECDSA-AES256-GCM-SHA384 — higher encryption level for sensitive data
• ECDHE-ECDSA-CHACHA20-POLY1305 — faster than AES on devices without hardware AES acceleration

Ciphers to Remove From TLS 1.2 Configuration

• RC4 — weak, prohibited by IETF in RFC 7465
• 3DES / DES-CBC3 — vulnerable to SWEET32 birthday attack
• NULL cipher — no encryption at all; extremely dangerous
• EXPORT ciphers — intentionally weakened for export; vulnerable to FREAK attack
• RSA key exchange (non-ECDHE) — no Forward Secrecy

The 5 TLS 1.3 Cipher Suites

Notice that TLS 1.3 cipher suites do not include a key exchange algorithm in the name — because TLS 1.3 mandates ECDHE for every session automatically. There is no longer a choice to make for key exchange, unlike TLS 1.2.

Checking TLS Version on Windows, macOS, and DirectAdmin

Beyond curl and OpenSSL on Linux/VPS servers, there are methods to verify TLS versions from other operating systems and hosting control panels.

Check via Browser DevTools

The quickest method for end users is Chrome DevTools. Open the target website, press F12, go to the Security tab, and click "View certificate." The Connection section shows the TLS version in use and the negotiated cipher suite.

Check with PowerShell (Windows)

$request = [Net.HttpWebRequest]::Create("https://yourdomain.com")
$request.GetResponse() | Out-Null
[Net.ServicePointManager]::SecurityProtocol

The output shows which protocols Windows has enabled, for example Tls12, Tls13.

Check from DirectAdmin

DirectAdmin shows certificates under Account Manager → SSL Certificates. Note that the panel only shows certificate status, not the actual TLS protocol configuration. Use SSL Labs or curl for a reliable TLS version check.

Detailed Cipher Audit with nmap

nmap --script ssl-enum-ciphers -p 443 yourdomain.com

This lists every supported cipher suite with a security rating (A/B/C), making it ideal for thorough security audits.

How TLS Affects SEO and Core Web Vitals

Upgrading TLS is not just a security matter — it directly affects page speed and the Core Web Vitals scores Google uses for ranking.

TTFB Drops With TLS 1.3

TTFB (Time to First Byte) measures the time from a browser sending a request to receiving the first byte back. When TLS 1.3 cuts the handshake from 2-RTT to 1-RTT, TTFB drops significantly — especially for users far from your server. If round-trip latency is 50 ms, eliminating one RTT saves 50 ms of TTFB, which directly improves your LCP (Largest Contentful Paint) score.

0-RTT Benefits Returning Visitors

Users who visit your site again benefit from TLS 1.3's 0-RTT session resumption, which has almost no handshake overhead at all. The result is noticeably faster INP (Interaction to Next Paint) and FCP (First Contentful Paint) for logged-in users and repeat visitors.

Google Treats HTTPS as a Ranking Signal

Google has counted HTTPS as a ranking signal since 2014. While it does not directly weight TLS version, sites running TLS 1.3 earn higher Best Practices scores in Lighthouse, and PageSpeed Insights will not flag "insecure protocol" warnings that could hurt overall user experience scores.

HTTP/2 and HTTP/3 Require TLS

HTTP/2 requires TLS in every browser implementation (even though the spec technically allows plaintext). HTTP/3 (QUIC) embeds TLS 1.3 directly into the protocol. Supporting TLS 1.3 is therefore a baseline requirement for HTTP/3, which further reduces latency and improves Core Web Vitals beyond what TLS 1.2 with HTTP/2 can achieve.

Migrating From Environments That Use Older TLS

If your server runs older OpenSSL or an older operating system, enabling TLS 1.3 may require an upgrade first. The table below summarizes the minimum requirements.

If you are on shared or managed hosting such as AsiaGB Hosting, the system updates OpenSSL and the web server automatically. Customers do not need to take any action — TLS 1.3 is available and active from day one.

Frequently Asked Questions About TLS 1.2 and TLS 1.3

Can I enable only TLS 1.3?

You can, but it is not recommended in 2026 because some older devices and browsers only support TLS 1.2. If you disable 1.2, those users will be unable to reach your site. The best approach is to enable both TLS 1.2 and 1.3 together for maximum compatibility while staying secure.

Does upgrading to TLS 1.3 require a new SSL certificate?

No. TLS is about the connection protocol, while an SSL certificate handles identity verification. Your existing certificate works with TLS 1.3 immediately — you only need to update your server configuration to enable TLS 1.3 and make sure OpenSSL is version 1.1.1 or newer.

Will disabling TLS 1.0/1.1 lock out older customers?

It only affects very old devices such as Windows XP or Android versions earlier than 5.0, which now represent a tiny share of users. Every modern browser supports at least TLS 1.2, so disabling 1.0/1.1 is a safe, necessary step to meet PCI DSS compliance.

How do I know my site meets TLS security standards?

The easiest way is to test your domain at SSL Labs (ssllabs.com/ssltest). If you score an A or A+ and the report shows only TLS 1.2/1.3 supported, you have passed. With AsiaGB Hosting, TLS 1.3 is enabled and old versions are disabled automatically.