# Is there any special settings for disabling TLSv1.1 from the elasticsearch?

**URL:** <https://discuss.elastic.co/t/is-there-any-special-settings-for-disabling-tlsv1-1-from-the-elasticsearch/233716>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [May 21, 2020, 9:59am UTC](https://discuss.elastic.co/t/is-there-any-special-settings-for-disabling-tlsv1-1-from-the-elasticsearch/233716 "2020-05-21T09:59:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bingu\_Shim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bingu_shim/32/57949_2.png) [@Bingu\_Shim](https://discuss.elastic.co/u/Bingu_Shim)\
**Post date:** [May 21, 2020, 9:59am UTC](https://discuss.elastic.co/t/is-there-any-special-settings-for-disabling-tlsv1-1-from-the-elasticsearch/233716/1 "2020-05-21T09:59:47Z")

</div>

Hello,

I'm trying to disable TLSv1.1 from the supported ssl protocol.  
I referenced [THIS GUIDE](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html), and change 'xpack.security.transport.ssl.supported\_protocols' as follow

```auto
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  http:
    service:
      spec:
        type: LoadBalancer
    tls:
      certificate:
        secretName: <my cert>
  version: 7.6.2
  nodeSets:
    - name: node
      count: 1
      config:
        node.master: true
        node.ingest: true
        node.data: true
        node.store.allow_mmap: true
        xpack.security.authc.realms.native.native1.order: -99
        xpack.security.transport.ssl.supported_protocols: TLSv1.2
      podTemplate:
        metadata:
          labels:
            name: node
          annotations:
            "co.elastic.logs/module": elasticsearch
            "co.elastic.metrics/module": elasticsearch
            "co.elastic.metrics/period": "10s"
            "co.elastic.metrics/hosts": "${data.host}:80"
        spec:
          initContainers:
            - name: sysctl
              securityContext:
                privileged: true
              command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
          containers:
            - name: elasticsearch
              resources:
                requests:
                  memory: 4Gi
                  cpu: 1
                limits:
                  memory: 4Gi
                  cpu: 1
              env:
                - name: ES_JAVA_OPTS
                  value: "-Xms2g -Xmx2g"
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: 200Gi
            storageClassName: standard

```

I checked whether this setting is correctly applied to the Elasticsearch pod, and it was correctly applied as follow.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e85cee6558ca9e51666bbf72c49fc516fc200aa.png)

However, when I check with nmap, TLSv1.1 is still enabled.

```auto
> nmap --script ssl-enum-ciphers.nse <my elasticsearch domain> -p 9200 -Pn
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-21 18:36 KST
Nmap scan report for <my elasticsearch domain> (<my elasticsearch ip>)
Host is up (0.0064s latency).
rDNS record for <my elasticsearch ip>: 5.238.64.34.bc.googleusercontent.com

PORT STATE SERVICE
9200/tcp open wap-wsp
| ssl-enum-ciphers:
| TLSv1.1:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
|_ least strength: A

Nmap done: 1 IP address (1 host up) scanned in 2.02 seconds

```

Is there anymore settings for my usecase?

---

<div class="post-metadata">

**Author:** ![charith-elastic](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@charith-elastic](https://discuss.elastic.co/u/charith-elastic)\
**Post date:** [May 21, 2020, 10:54am UTC](https://discuss.elastic.co/t/is-there-any-special-settings-for-disabling-tlsv1-1-from-the-elasticsearch/233716/2 "2020-05-21T10:54:47Z")

</div>

You need to set `xpack.security.http.ssl.supported_protocols` in order to change the protocol used by the HTTP port (port 9200). In your current configuration, you have set the protocol preference for the **transport** port (9300) only but the test is checking the HTTP port (9200) -- which is different.

---

<div class="post-metadata">

**Author:** ![Bingu\_Shim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bingu_shim/32/57949_2.png) [@Bingu\_Shim](https://discuss.elastic.co/u/Bingu_Shim)\
**Post date:** [May 22, 2020, 6:15am UTC](https://discuss.elastic.co/t/is-there-any-special-settings-for-disabling-tlsv1-1-from-the-elasticsearch/233716/3 "2020-05-22T06:15:53Z")

</div>

Thanks @charith-elastic

It works~!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 7:59am UTC](https://discuss.elastic.co/t/is-there-any-special-settings-for-disabling-tlsv1-1-from-the-elasticsearch/233716/4 "2022-11-04T07:59:13Z")

</div>