It's nice to have this stat from Google. A lot of people make wild claims about how widely used TLS 1.0 is based on a glance at their webserver logs. But if you look more closely you'll see that a large percentage of 1.0 traffic is actually just hacked machines scanning for vulnerabilities, filling your logs and using your resources. It's not real traffic, and TLS 1.1 is microscopic in comparison to 1.0. As a percentage, very few sites would be harmed by disabling 1.0/1.1. Most sites can simplify their TLS stack and lose more bad than good by going TLS 1.2-only.
So I'm very glad to see Google deprecating and planning to disable 1.0/1.1.
To see the disabling of 1.0/1.1 over time check out SSL Pulse from SSL Labs (in the chart "Protocol Support"):
TLS 1.0 has been dropping like a rock. Maybe it's too late to be an "early adopter" of 1.2-only but regardless I think tech sites/people should lead the way there.
Both client and server will try to negotiate the best version they and their peer can manage, but the populations of those peers are different so the statistics are not necessarily well correlated.
One problem Chrome doesn't have to worry about, but your site might (especially if its demographics skew towards people with older and possibly out-of-support systems) is out-dated web browsers.
Also I'm going to link the diediedie draft, which is now superseded by a version with a more corporate name but I was amused because the IETF's script crashed when trying to render it, so rather than link the current one that doesn't do that here's the original with the funnier name and the crash:
But from a server perspective, you still have trouble with old clients, particularly Windows XP.
Slowly disappearing but not gone yet.
Fortunately SNI (i.e. not requiring a dedicated IP per SSL customer) is becoming so commonplace that a lot of those browsers are getting broken anyway, which will probably speed up that deprecation.
It looks like you can still have older TLS versions enabled as long as TLS 1.2 or later is supported.
Most people just won't bother to change their configurations, short of some kind of external pressure. Support for new protocols will often be driven by "Is it supported out of the box" on appliances, Apache, Nginx etc. shipped by distributions.
edit: HTTP 2.0 support at 31%? That's higher than I expected, and a good sight to see. Wonder how much of that is driven by cloudflare etc?
Feel free to point to this comment as evidence that logs should not be trusted.
Curious who the 0.5% are. Presumably Chrome is doing it's best to avoid falling back to TLS 1.0 or 1.1 unless necessary, so presumably these are sites that just don't support 1.2.
Apache added TLS 1.2 support 6.75 years ago: http://svn.apache.org/viewvc?view=revision&revision=1222922
I'm curious how many of those sites just haven't upgraded their server in ~7 years.
For example, in Python you can ask for a specific TLS version ("Oooh, TLS 1.1 just came out, let's use that") or you can ask for what it calls "SSLv23" which means any protocol in the SSL/ TLS family whatsoever. But only in very recent 3.x Python releases can you easily specify "Um, anything above TLS 1.0 is OK?" even though that is clearly both more useful AND more likely to result in the software working as intended in future.
In fact, software developers reading this: You probably didn't implement TLS yourself (OK, the six smug people thinking "Yes I did", this isn't for you, you've already read and perhaps written similar rants before). TLS 1.3 was finished earlier this year. How many programs that you wrote more than six months ago are you sure will "just work" with TLS 1.3 if the relevant libraries or OS features are upgraded to support it? How many do you think will tell the library/ OS/ framework/ whatever "Oh, no, I definitely want TLS 1.2" even though actually it wants security, and TLS 1.3 would improve that?
libcurl has the same thing. A really common problem in PHP ecommerce libraries and applications is the misuse of CURLOPT_SSLVERSION to pin a specific protocol version. Then their payments stop working every few years ...
A Firefox Nightly can be configured to do D-PRIVE (specifically DNS-over-HTTPS to Cloudflare) and do eSNI, and thus connect to a default configured Cloudflare site without any indication to other parties about which one...
Some other cloud providers or CDNs have made interested noises, if those noises weren't just for the public record they might begin doing the exact same thing in short order, especially if the Firefox tests go well.
I just had an idea that might be able to work around this though:
1. Create a new TLD: .ip. All *.ip domains are valid ip addresses (in some encoding, e.g. 740-125-138-139.ip, or anything else) and they always resolve to the ip address specified.
2. Automatically issue certificates for each host for each of the ips that they serve on. (Thank you Lets Encrypt)
3. Every new connection made can just use the ip-domain as the esni originating host, because you can know that every host is serving https://ownip.ip.
This doesn't solve the fact that server ips are still fairly unique, and so a reverse dns might be enough to find the host, but it doesn't leak any more information than what the IP header already leaks, and it doesn't require leaning even more on increasingly centralized proxies like CloudFlare.
The address must appear as a SAN ipAddress to work in modern browsers like Chrome and Firefox
The address must appear as either a SAN dnsName or as the X500 series Common Name to work with older Microsoft SChannel implementations.
Key root programme rules and the Baseline Requirements mean that:
IP addresses must not appear as a SAN dnsName (they're IP addresses, writing them out as text doesn't mean now they're part of the DNS system) but only as a SAN ipAddress
The X500-series Common Name must be the textual representation of one of the SANs (doesn't matter which one).
As a result the only compliant certificates for IP addresses that also work in older IE / Edge releases do this:
1. Write exactly one IP address as a SAN ipAddress
2. Write the same IP address, but as a text string as the Common Name.
There are a LOT of certificates that do something else, some of them work but aren't compliant (and so get finger wagging from people like me) some are compliant and don't work in older Windows systems (which may be OK if you're building a new system for like CentOS users, who cares if it works in Windows?) but only the pair of traits I described above manage to be compliant while also working, and they're limited to a single IP address per certificate.
Hey, at least Windows 10 finally groks SAN ipAddresses, in another decade we might not need a workaround.
Is this just a restriction on current CAs? I have a self-signed certificate on my router (more out of curiosity than any practical benefit), and it comes up fine on https://192.168.1.1/
It wasn't that long ago I had to sell clients on a separate IP address just to set up HTTPS. Let's Encrypt using SNI allowed me to secure everyone for free.
It would seem these announcements (Chrome/Safari/Edge TLS 1.0/1.1 deprecation) were coordinated.
Edit: The Microsoft announcement says as much.
If you want Nginx to use TLS v1.2, this is what you need:
ssl_protocols TLSv1.3 TLSv1.2;
Might not be reflected in browsing stats, but according to this: https://developer.android.com/about/dashboards/ it's 3.8% of Android users. And that number undercounts non-Google Play Services using Android devices.
Old clients (such as Android) will still be fine, if the servers don't also turn off older versions/options.
When you're handling your own PII and potentially others (contacts, addresses, phone numbers etc) I think having an absolute minimum requirement is beneficial for the Internet as a whole; for example, it'd not be easy to use Windows XP and access the Internet, for good reason, I'd hope (I can't verify that but I doubt browsers still work there).
This is good news all around, forcing people to upgrade is a good idea in the long run.
 is a comparison of OpenSSL with the various experimental implementations of Disco (tl;dr: 700k LOC vs 1k LOC)
The thing is at https://www.discocrypto.com
(disclaimer: it's quite experimental at the moment)