> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/troubleshooting-and-resources/armory/general/disabling-tls-1-1-in-spinnaker-and-specifying-the-protocols-to-be-used.md).

# Disabling TLS 1.1 in Spinnaker and Specifying the Protocols to be used

### Introduction <a href="#introduction" id="introduction"></a>

As TLS 1.1 has reached end of life, customers may want to disable it from the available protocols in Spinnaker, and consider which protocols and Cipher Suites to enable.

### Instructions <a href="#instructions" id="instructions"></a>

**In Operator**

The following entries would need to be added in the `profiles` section of the Spinnaker Manifest. In Operator, go to `spec.spinnakerConfig.profiles.spinnaker` and then look to make the following modification:

```
apiVersion: spinnaker.armory.io/v1alpha2
kind: SpinnakerService
metadata:
  name: spinnaker
spec:
  spinnakerConfig:
    profiles:
      spinnaker:
        default:
          cipherSuites:
          - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
          - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
          - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
          - TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
          - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
          - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
          - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
          - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
          - TLS_AES_256_GCM_SHA384
          - TLS_CHACHA20_POLY1305_SHA256
          - TLS_AES_128_GCM_SHA256
        ## For embedded systems, the below two ciphers may be necessary.  Normally, no need to  include these though they're a TLS1.3 cipher
        #  - TLS_AES_128_CCM_8_SHA256
        #  - TLS_AES_128_CCM_SHA256
          tlsVersions:
          - TLSv1.2
          - TLSv1.3
[...]
```

Next, redeploy the manifest and it will then limit the protocol usage to TLSv1.1. The above is an example for limiting the protocols and excluding TLSv1.1, but it can be modified to further limit TLS protocol versions.

**In Halyard**

In the hal config profiles directory e.g. (`~/.hal/default/profiles/`), please add the following to the `spinnaker.yml` file, or create a new file if it doesn't already exist. In the file, add the following code:

```
default:
  cipherSuites:
  - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
  - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  - TLS_AES_256_GCM_SHA384
  - TLS_CHACHA20_POLY1305_SHA256
  - TLS_AES_128_GCM_SHA256
## Embedded systems is where yoU MIGHT see these - would not normally include these though they're a TLS1.3 cipher <a href="#embedded-systems-is-where-you-might-see-these-would-not-normally-include-these-though-theyre-a-tls13-cipher" id="embedded-systems-is-where-you-might-see-these-would-not-normally-include-these-though-theyre-a-tls13-cipher"></a>
# - TLS_AES_128_CCM_8_SHA256 <a href="#tlsaes128ccm8sha256" id="tlsaes128ccm8sha256"></a>
# - TLS_AES_128_CCM_SHA256 <a href="#tlsaes128ccmsha256" id="tlsaes128ccmsha256"></a>
  tlsVersions:
  - TLSv1.2
  - TLSv1.3
```

Next, redeploy the manifest with `hal deploy apply` and it will then limit the protocol usage to TLSv1.1. The above is an example for limiting the protocols and excluding TLSv1.1, but it can be modified to further limit TLS protocol versions.