Disabling all older versions of ssl in Apache 2 to force authentication over TLS 1.2

I read here that all (older?) versions of SSL need to be disabled in order to force TLS 1.2 authentication.

That's not what it says! It says all versions of SSL need to be disabled to force use of TLS - not to force use of TLSv1.2.

SSL/TLS comes in a number of versions, in increasing order of age and security:

1. SSLv2
2. SSLv3
3. TLSv1
4. TLSv1.1
5. TLSv1.2

SSLv1 was never made available to the public and TLSv1.3 is currently being worked on.

In theory the browser should use the strongest available which both it and the server support, but there are downgrade attacks which cause lower versions to be used which can then be broken so best to turn off ones you don't want used so they simply cannot be used.

It's generally accepted that SSLv2 and SSLv3 are now insecure due to a combination of flaws found in them and increases in compute power meaning they can be broken. So you should definitely disable them using the following:

SSLProtocol all -SSLv2 -SSLv3

Note SSLv2 is usually off by default now but no harm being explicit.

TLSv1 is interesting. PCI Compliance standard (used when you accept payments by cards on your website) has recently mandated turning off TLSv1 too but it's still needed for some browsers still in use so that may well hurt some of your users (e.g. IE8 users on XP - yes even though XP is officially retired and unsupported it's still in use). Personally I think we're almost ready to turn that off but not quite yet.

TLSv1.1 is another interesting one. TLSv1.2 came out shortly after and nearly every browser that supports 1.1 also supports 1.2 so usage of 1.1 is tiny. So if you're looking to firm up your SSL/TLS config then might be just as well to skip that one and go straight to TLSv1.2 only rather than both which will save you turning it off later when some vulnerability is found later. On the flip side it is still secure and maybe that tiny subset of browsers are some of your visitors.

So if you want just TLSv1.2 (with option of TLSv1.3 in future) then you can use this config:

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

Or alternatively just this (though limiting you to just TLSv1.2 no matter what come along later):

SSLProtocol TLSv1.2

You can also measure your current usage using a custom log format, so you can see how many of your visitors still use TLSv1 for example: http://httpd.apache.org/docs/current/mod/mod_ssl.html#logformats

However that's not the whole story for having a strong https setup.

For a start it depends heavily on the version of OpenSSL you have installed and/or the version it was compiled with. That might mean TLSv1.2 is not even available to you - there are many OpenSSL 0.9.8 installs still out there!

Next up is the CipherSuite you use within that version of SSL/TLS. Some are more secure than others and some have more performance hit than others. You also should specify that the server should specify the order so your strongest suite is used. This is (at the time of writing) a strong suggestion with still good legacy support:

SSLHonorCipherOrder on
SSLCipherSuite "EECDH+AES128:EECDH+AES256:+SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RSA+3DES:!DSS"

Then there's other options like compression, HSTS, CT, HPKP and OCSP Stapling but they really are specialist subjects and beyond the scope of this question (blogged about them here if interested in further reading: https://www.tunetheweb.com/security/https/ )

The best option for testing your https set up is the online https://www.ssllabs.com/ssltest tool. Just plug your website address in and a couple of minutes later you're have a report on how good your setup is. IMHO there is no good reason not to get an A grade here unless you are on old hardware/software (in which case why are you not upgrading?). If looking after a website I'd strongly suggest re-running that test once a quarter to check on any new developments and config changes that you might need to do to stay on top of your config.