# Client requested protocol tlsv1 is not enabled or supported in server context **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 25, 2020, 7:22am UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610 "2020-11-25T07:22:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![adnanahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adnanahmed/32/45836_2.png) [@adnanahmed](https://discuss.elastic.co/u/adnanahmed)\ **Post date:** [November 25, 2020, 7:22am UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610/1 "2020-11-25T07:22:18Z")
Hi, we are using ELK stack version 7.9.0 , when we try to connect logstash with elastic it give us error . 'client requested protocol tlsv1 is not enabled or supported in server context' when we specify following parameter in elasticsearch.yml file it works fine. xpack.security.http.ssl.supported\_protocols: ["TLSv1.2", "TLSv1.1", "TLSv1"] we donot want to use TLSv1 protocol but without above parameter our connection of logstash with elastic never establish. could someone suggest alternative approach as how can we avoid TLS1 in our case. Thanks, Adnan ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 25, 2020, 7:47am UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610/2 "2020-11-25T07:47:57Z")
Given that [this issue](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/624) is still unresolved, I don't think there is a way to configure this in logstash's elasticsearch output plugin at the moment unfortunately. You can configure your JVM to disallow TLS1.0 and TLS1.1 , thus forcing Logstash to use TLSv1.2. Depending on how you have installed logstash and which JVM you are using ( see [https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html#ls-jvm](https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html#ls-jvm) ) , you need to locate the `java.security` file within the jdk dir. In there there is a `jdk.tls.disabledAlgorithms=` line to which you can add `TLSv1, TLSv1.1` . HTH ---
**Author:** ![adnanahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adnanahmed/32/45836_2.png) [@adnanahmed](https://discuss.elastic.co/u/adnanahmed)\ **Post date:** [November 25, 2020, 1:16pm UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610/3 "2020-11-25T13:16:21Z")
Thanks loannis Kakavas for your immediate reply , much appreciated. after adding [TLSv1, TLSv2] to java.security we are getting this. 'No appropriate protocol, may be no appropriate cipher suite specified or protocols are deactivated"}' Moreover we have another instance of ELK 7.9.0(on another machine) where we didn't need to specify xpack.security.http.ssl.supported\_protocols: ["TLSv1.2", "TLSv1.1", "TLSv1"] and connection of logstash to elasticsearch went through fine. We still couldn't figure that why it is needed on one instance while other one is doing fine without it. Thanks, Adnan ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 25, 2020, 1:43pm UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610/4 "2020-11-25T13:43:23Z")
> [@adnanahmed](#): > > after adding [TLSv1, TLSv2] to java.security we are getting this. Mind you the `jdk.tls.disabledAlgorithms= ` controls the versions that need to be **disabled** on the JVM level. It's **not the same** as `supported_protocols` that dictates the versions that should be **enabled**. In that sense adding both ` [TLSv1, TLSv2]` to`jdk.tls.disabledAlgorithms=`, makes no sense. You should add only `TLSv1` ( i.e. disable only TLSv1 ) ---
**Author:** ![adnanahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adnanahmed/32/45836_2.png) [@adnanahmed](https://discuss.elastic.co/u/adnanahmed)\ **Post date:** [November 25, 2020, 1:54pm UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610/5 "2020-11-25T13:54:42Z")
Hi loannis Kakavas , correction above TLS v2 is not part of disable algorithm. we are disabling TLSv1, TLSv1.1 only. i.e. jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1 while commenting below in elasticsearch.yml #xpack.security.http.ssl.supported\_protocols: ["TLSv1.2", "TLSv1.1", "TLSv1"] ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 23, 2020, 1:55pm UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610/6 "2020-12-23T13:55:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.