I'm trying to secure my infrastructure to meet the PCI-DSS standard using securitymetrics.com. The standard mandates the use of TLS 1.1 minimum (with a CBC cipher). TLS 1.0 is not allowed.

While securing ftp (vsftpd), I have disabled sslv2 and sslv3, but couldn't block TLS 1.0 without also disabling TLS 1.1 and TLS 1.2. The config file has the ssl_tlsv1 option that can be set to YES or NO, but I don't see any way to distinguish between 1.0 and later versions.

How can I enable only TLS 1.1 and better?

  • 1
    You are working with an unconventional definition of "securing". Can you describe more precisely what you are trying to do? Do you want to turn encryption off entirely? – Law29 Jul 18 '16 at 19:02
  • 1
    I'm doing for passing PCI securitymetrics.com it showing Tlsv1.0 is enabled and the server support least one cipher – adminz Jul 18 '16 at 19:12
  • ssl_tlsv1=NO works for you? – Navern Jul 18 '16 at 19:37
  • Then I can't connect using filezilla and cuteftp. Also can l enable tlsv1.1 by ssl_tls1.1=yes ? – adminz Jul 18 '16 at 19:40
  • I would suggest : ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO ssl_ciphers=HIGH – krisFR Jul 18 '16 at 20:02

Answer isn't posted, so I thought I'd follow up for the rest...

To disable TLSv1.0 and enable TLSv1.1 and TLSv1.2 just add these two lines and change the third:


Note that these options are only available with a patched version of vsftpd, and seems to be only installed on CentOS, and specifically not on Ubuntu. Other distributions may have the patched version as well.

  • 1
    This causes an error when this configuration is used. It doesn't detect ssl_tlsv1_2 and ssl_tlsv1_1 as valid arguments. – Daniel Harris May 28 '19 at 18:03
  • @DanielHarris dod you find a solution? – Fede E. Aug 1 '19 at 16:03
  • Where the hell did you get this configuration? It's not even in the manual! – The Quantum Physicist Nov 19 '19 at 17:00

The vsftpd options of ssl_tlsv1_1 and ssl_tlsv1_2 appear to have been introduced in a patch called vsftpd-2.2.2-tlsv1_2.patch that is included in the vsftpd source code for RHEL-based distributions (checked on CentOS 7). The official vsftpd website and source code from Ubuntu repositories do not appear to include this patch or these tunable options (checked on Ubuntu 18.04).


To limit VSFTPD to TLS 1.2, try setting: ssl_ciphers=TLSv1.2

I don't know if there's an easy way to limit the connection to TLS 1.1 and 1.2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.