# The server selected protocol version TLS11 is not accepted by client preferences \[TLS12, SSL20Hello\] **URL:** \ **Category:** Configuring the server\ **Created:** [February 13, 2021, 8:59pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371 "2021-02-13T20:59:16Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![soundsessential](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@soundsessential](https://forum.keycloak.org/u/soundsessential)\ **Post date:** [February 13, 2021, 8:59pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/1 "2021-02-13T20:59:16Z")
I’m trying to set up the email configuration in a new realm in the admin console. All the email details are correct and when I test the connection it fails. In looking in the logs it says this: `javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS11 is not accepted by client preferences [TLS12, SSL20Hello]` I have tried adding this: `-Djdk.tls.client.protocols=TLSv1.1,TLSv1.2` to /opt/keycloak/current/bin/standalone.conf and I know that’s working because if I force 1.1 only then Keycloak is not accessible over port 8443. But this doesn’t seem to having any effect on sending emails. The email server I am using does have 1.2 but still has 1.1 available but deprecated - I don’t know why it’s choosing to use 1.1 but maybe that’s a different problem. Anyone know how to enable TLSv1.1 for sending out emails? Many thanks. ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [February 14, 2021, 12:07am UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/2 "2021-02-14T00:07:15Z")
TLS 1.1 is deprecated. So you may open a security hole if you allow it. I would rather fix TLS preference on the mail server. ---
**Author:** ![soundsessential](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@soundsessential](https://forum.keycloak.org/u/soundsessential)\ **Post date:** [February 14, 2021, 12:10am UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/3 "2021-02-14T00:10:51Z")
Thanks @jangaraj. Yeah I appreciate the fact it’s deprecated and insecure. I tried a different email provider and that works fine. The one not working is a huge provider for email worldwide so it’s a bit weird and I doubt I can make any headway with having them address the issue. If I wanted to accept the risk, is it possible to do? ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [February 14, 2021, 7:58am UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/4 "2021-02-14T07:58:44Z")
IMHO it is configured on the JVM level, so overriding from the app doesn’t work. Check documentation of used java. Maybe it can be configured in java.security file, default properties,… ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [February 14, 2021, 4:11pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/5 "2021-02-14T16:11:44Z")
I had once the issue, that I had to enable something on OS level, not on the JVM. I searched my … off to find this out. But don’t ask me now, what exactly it was at theses former days… some “legacy” set of encryption policies on the OS. Fixing SSL/TLS issues is always a big PITA! Worse than timezones and encoding. ---
**Author:** ![nicolabeghin](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nicolabeghin/32/2408_2.png) [@nicolabeghin](https://forum.keycloak.org/u/nicolabeghin)\ **Post date:** [February 16, 2021, 8:46pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/7 "2021-02-16T20:46:44Z")
For anyone stumbling on this: on RedHat-based delete this file ``` /etc/crypto-policies/back-ends/java.config ``` and TLS1.0 will work without changing anything else, at least with official Keycloak images. This is because such OS-specific settings override the JDK security policy so even if you change them in JAVA\_HOME they will not be picked up. ---
**Author:** ![soundsessential](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@soundsessential](https://forum.keycloak.org/u/soundsessential)\ **Post date:** [February 16, 2021, 9:15pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/8 "2021-02-16T21:15:34Z")
It might be worth first trying to edit that file and removing the disabled security protocols that you want enabled, or you may be opening up your server to more than you want to. I did try this and I believe TLS 1.1 was enabled but in trying to send an email I got an error again about possible downgraded attack. So, I’m back to using an email provider that is using TLS 1.2. Thanks for the help with this @nicolabeghin ---
**Author:** ![nicolabeghin](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nicolabeghin/32/2408_2.png) [@nicolabeghin](https://forum.keycloak.org/u/nicolabeghin)\ **Post date:** [February 16, 2021, 9:57pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/9 "2021-02-16T21:57:40Z")
@soundessential absolutely true, but after 3 days on this I preferred to stick to out-of-the-box JDK policies without external OS interferences, expecially because we’re taking about Docker images (it really drove me crazy :D) ---
**Author:** ![nicolabeghin](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nicolabeghin/32/2408_2.png) [@nicolabeghin](https://forum.keycloak.org/u/nicolabeghin)\ **Post date:** [May 5, 2021, 7:20pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/10 "2021-05-05T19:20:34Z")
Addition from May 2021 for updated `Dockerfile` to enable back TLS1.0: ``` RUN rm /etc/crypto-policies/back-ends/java.config &&\ sed -i 's/jdk\.tls\.disabledAlgorithms=SSLv3, TLSv1, TLSv1\.1/jdk\.tls\.disabledAlgorithms=SSLv3/' /usr/lib/jvm/jre-11/conf/security/java.security ``` ---
**Author:** ![marquespedro](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/marquespedro/32/11514_2.png) [@marquespedro](https://forum.keycloak.org/u/marquespedro)\ **Post date:** [October 26, 2024, 10:18pm UTC](https://forum.keycloak.org/t/the-server-selected-protocol-version-tls11-is-not-accepted-by-client-preferences-tls12-ssl20hello/7371/11 "2024-10-26T22:18:09Z")
This works for me! Thanks. Keycloak 9.0.3