GICT knowledge base
End of TLS1 and TLS 1.1 support in cPanel as of version 132
Published
The End of an Era: Why TLS 1.0 and 1.1 Are Gone, and What it Means for cPanel Users
* Update: If Dovecot settings under Web Host Manager >> mailserver configuration is set to SSLv3 dovecot will fail to start up as of cpanel 132. While tls 1.0 and 1.1 will be ignored, but dovecot will start, sslv3 will show Can’t set minimum protocol to ‘SSLv3’ (ssl_min_protocol setting): Unknown value:.
Please be aware, cPanel has depreciated these ssl ciphers as of cpanel 92 and will offer no fix to get these older ciphers working and downgrades are not possible. The full fix is getting the end system to use tls 1.2.
In the world of web security, standing still means falling behind. As we focus on faster, more secure connections, we have to say goodbye to the technologies that no longer protect us.
For years, the internet has been moving away from outdated security protocols. Now, with the rollout of cPanel & WHM version 132, this change is becoming final for many server administrators. Support for the obsolete TLS 1.0 and 1.1 protocols is officially over.
Here’s what that means, why it’s happening, and what you need to do about it.
What Are TLS 1.0 and 1.1?
TLS stands for Transport Layer Security. It’s the cryptographic protocol that powers the “S” in “HTTPS,” ensuring that the data transferred between your computer and a website’s server is encrypted and private.
- TLS 1.0 (released in 1999) and TLS 1.1 (released in 2006) were the workhorses of web security for over a decade. They encrypted trillions of connections and built the foundation of online trust.
- However, they are now critically outdated. Over the years, security researchers have discovered significant vulnerabilities in them, such as POODLE and BEAST.
- These flaws can (in some cases) allow attackers to decrypt sensitive information. Furthermore, these old protocols do not support modern, stronger, and more efficient encryption ciphers that are the standard today (like AES-GCM or ChaCha20-Poly1305).
In simple terms: using TLS 1.0 or 1.1 in 2024 is like putting a simple padlock on a bank vault.
The Official End-of-Life
The internet community has known this day was coming for a long time.
All major web browsers—including Google Chrome, Firefox, Apple Safari, and Microsoft Edge—stopped supporting TLS 1.0 and 1.1 back in early 2020.
The final nail in the coffin came from the Internet Engineering Task Force (IETF), the body that defines internet standards. They officially deprecated both protocols in March 2021 (published as RFC 8996), formally declaring them obsolete and recommending that they no longer be used.
How This Affects cPanel & WHM
cPanel is now enforcing this global standard.
Based on recent verifications, cPanel version 132 no longer supports the ciphers for TLS 1.0 and 1.1. This has been confirmed on systems running cPanel 132.0 (build 7) with Dovecot 2.4.
While older versions (like cPanel 130 and below) might have allowed administrators to manually enable these weak ciphers for “legacy” purposes, that option is now gone in version 132. This is a hard-stop, forcing all servers on this version to use the more secure TLS 1.2 or TLS 1.3.
Interestingly, this major security enhancement is not currently documented in the official cPanel 132 Change Log or the announcement blog post. This makes it a crucial “heads-up” for administrators who might otherwise be caught off guard.
Upgrade Timelines and Legacy Risks
This change will roll out to different servers at different times, and it highlights a major risk for anyone running an old system.
Upgrade Path
- CURRENT Tier: cPanel 132 is currently available in the “CURRENT” release tier, so servers on this tier already have this change.
- STABLE Tier: It is expected that systems running the “STABLE” version of cPanel will be updated to version 132 by January 2026.
The Legacy Server Warning
This is where the real danger lies. Legacy servers, such as those running CentOS 7 or CloudLinux 7, are typically stuck on cPanel 110.
These operating systems are already End of Life (EOL). They receive limited security support, and that support is expected to end completely after June 2026.
This creates a two-fold problem:
- These servers cannot be upgraded to cPanel 132 to get the latest features.
- They will soon stop receiving security updates of any kind, leaving them permanently vulnerable.
- For Website Owners:It is time to update to a mail client or operating system that will support tls 1.2 or above
- For Server Administrators:
- If you are on the STABLE tier: Begin planning for the cPanel 132 update. Be aware that when you are upgraded (by Jan 2026), any legacy client or service still relying on TLS 1.0/1.1 will stop working.
- If you are running a legacy OS (CentOS 7, etc.): You are on borrowed time. You must begin planning a migration to a supported OS (like AlmaLinux 8 or 9) immediately. The June 2026 end-of-support date is a hard deadline that should not be ignored.
What You Should Do
This transition is a positive and necessary step for a more secure web. Here’s your action plan:
The web is moving forward. The removal of these ancient protocols is a good thing and it is likely only a few users are using these ciphers. However if you have no alternatives please review a possible way to enable tls 1.1 for rhel8 based systems.