I'm trying to secure my infrastructure to meet the PCI-DSS standard using securitymetrics.com. The standard mandates the use of TLS 1.1 minimum (with a CBC cipher). TLS 1.0 is not allowed.
While securing ftp (vsftpd), I have disabled sslv2 and sslv3, but couldn't block TLS 1.0 without also disabling TLS 1.1 and TLS 1.2. The config file has the
ssl_tlsv1 option that can be set to YES or NO, but I don't see any way to distinguish between 1.0 and later versions.
How can I enable only TLS 1.1 and better?