Enable TLS 1.0 and TLS 1.1 on Ubuntu 20.04

Solution 1:

I finally found out how to enable for nginx (afraid I don't know how to do it system-wide) and other services with a configuration allowing changing ciphers.

Source: man ciphers.1ssl

Edit your nginx configuration and amend your cipherlist to add the pseudocipher @SECLEVEL=1.

Example:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

becomes

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
# seclevel for TLS 1.0 and 1.1
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:@SECLEVEL=1";

Solution 2:

For GnuTLS, as explained in

https://discourse.ubuntu.com/t/default-to-tls-v1-2-in-all-tls-libraries-in-20-04-lts/12464/8

create /etc/gnutls/config (both directory and files were missing) with the following content:

[overrides]
default-priority-string = NORMAL

This was enough to fix the following error in evolution (due to a pop3 server lacking TLS-1.2 support):

A packet with illegal or unsupported version was received

There were other instructions in this link for system-wide openSSL "fix", not tested.