Docs

Torch Object Storage

Data security

Configuring the TLS version

Transport Layer Security (TLS) is an encryption protocol that ensures the security of communications over the Internet. TOS allows you to use specific TLS versions for secure communication. This topic provides background information and instructions for configuring TLS versions.

Background information

When a TOS server and client connect, they negotiate and select a TLS version that they both support. If they both support multiple versions, the server prioritizes the highest version it can offer. Once a TLS version is agreed upon, the server and client use it to securely transmit data.

By default, TOS supports TLS versions 1.0, 1.1, and 1.2 when the TLS version setting is disabled. After enabling this feature, you can choose to enable the following protocols: TLS 1.0, 1.1, 1.2, and 1.3. To enhance security, you can specify the minimum and maximum TLS versions in the TOS console. Once configured, clients can only establish secure connections with the TOS server using TLS versions within the specified range.

Understanding TLS versions

There have been several versions of TLS, each offering different features and levels of security. Although higher versions offer better security, they may be incompatible with browsers that use earlier versions.

TOS supports TLS 1.0, 1.1, 1.2, and 1.3. The security levels and mainstream browser support for each version are described below.

Version	Security notes	Supported browsers
TLS 1.0	TLS 1.0 has known security vulnerabilities that attackers can exploit. For this reason, TLS 1.0 is no longer recommended for general secure communications.	Microsoft Internet Explorer 6+ Google Chrome 1+ Mozilla Firefox 2+
TLS 1.1	Although TLS 1.1 improves the security of the encryption algorithm and protects the integrity of messages, it has issues such as insufficient key length and weak attack resistance. While TLS 1.1 is more secure than TLS 1.0, it is still vulnerable. For this reason, it has been replaced by later versions, such as TLS 1.2.	Microsoft Internet Explorer 11+ Google Chrome 22+ Microsoft Edge 12+ Mozilla Firefox 24+ Apple Safari 7+ Opera 12.1+
TLS 1.2	TLS 1.2 restricts the use of insecure cryptographic algorithms and introduces stronger cipher suites, such as AES-GCM. It offers high security, good performance, and compatibility, while effectively resisting various attacks. TLS 1.2 is suitable for most scenarios requiring secure network communication.	Microsoft Internet Explorer 11+ Google Chrome 30+ Microsoft Edge 12+ Mozilla Firefox 27+ Apple Safari 7+ Opera 16+
TLS 1.3	TLS 1.3 streamlines the handshake process, eliminates insecure cryptographic algorithms, and introduces stronger key exchange mechanisms and ciphers. These changes improve user privacy and offer greater security and communication efficiency. It is ideal for industries with strict security requirements, such as finance and healthcare.	Google Chrome 70+ Microsoft Edge 79+ Mozilla Firefox 63+ Apple Safari 14+ Opera 57+

Notes

Before disabling a specific TLS version, make sure that none of your clients rely exclusively on it. Otherwise, those clients will be unable to access TOS.

Switching to a lower TLS version or disabling TLS version settings could pose security risks, so proceed with caution.

Since TLS 1.2 is the most widely adopted version, excluding it may prevent many clients from accessing the bucket. Be sure to include TLS 1.2 version at a minimum.

Steps

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Security > TLS version settings.

On the TLS version settings page, click Edit and set the following parameters:

Parameter	Description
TLS version settings	Select whether to enable the TLS version settings feature.
Minimum TLS version	Set the minimum TLS version allowed for client connections. Connection requests using a lower version will be rejected. Options are TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.
Maximum TLS version	Set the maximum TLS version allowed for client connections. Connection requests using a higher version will be rejected. Options are TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3. tip The maximum TLS version cannot be lower than the minimum TLS version.

Once you have finished configuring, click Select.

In the box that appears, click OK.

Related operations

Check the current TLS version

Run this command to retrieve the TLS version used by the client and server.

The command returns output containing text similar to the following:

Last updated: 2026.01.21 16:38:31