如何通过cPanel终端将TLS版本修改为1.1？

可以通过终端修改Web服务器配置来启用TLS 1.1，以下是主流服务器的操作步骤：

Nginx #

• 找到Nginx的配置文件，通常在/etc/nginx/nginx.conf或者/etc/nginx/sites-available/目录下的站点专属配置文件
• 用文本编辑器打开配置文件，在server块或者全局http块中添加/修改以下配置：

  ssl_protocols TLSv1.1 TLSv1.2; # 保留TLS 1.1和1.2，适配Windows 7的同时兼顾基础安全性
  ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
  ssl_prefer_server_ciphers on;
  

• 保存文件后，先测试配置是否合法：nginx -t
• 测试通过后重启Nginx生效：systemctl restart nginx

Apache #

• 找到Apache的SSL配置文件，常见路径是/etc/httpd/conf.d/ssl.conf（CentOS/RHEL）或/etc/apache2/sites-available/你的站点SSL配置文件.conf（Ubuntu/Debian）
• 打开文件后添加/修改以下指令：

  SSLProtocol TLSv1.1 TLSv1.2
  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
  SSLHonorCipherOrder on
  

• 测试配置正确性：apachectl configtest（CentOS/RHEL）或apache2ctl configtest（Ubuntu/Debian）
• 重启Apache生效：systemctl restart httpd或systemctl restart apache2

IIS（Windows服务器） #

• 以管理员身份打开PowerShell，执行以下命令启用TLS 1.1的服务器和客户端支持：

  # 启用TLS 1.1客户端
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" -Name "Enabled" -Value 1 -PropertyType DWORD -Force
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" -Name "DisabledByDefault" -Value 0 -PropertyType DWORD -Force
  # 启用TLS 1.1服务器
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Name "Enabled" -Value 1 -PropertyType DWORD -Force
  New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Name "DisabledByDefault" -Value 0 -PropertyType DWORD -Force
  

• 执行完后重启Windows服务器，配置才会生效

额外提醒 #

• TLS 1.1属于老旧协议，存在安全漏洞，建议只在必须兼容Windows 7的场景下启用，同时搭配上述安全加密套件降低风险
• Windows 7默认可能没开启TLS 1.1/1.2，需要在客户端的「Internet选项」-「高级」标签里勾选对应选项，或者通过注册表配置批量启用

内容的提问来源于stack exchange，提问作者Prestige