---
title: 'Tutorial: Select the SSL and TLS Levels on the Web Server'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--tls-web-server/
product: Access Server Docs
description: Configure the minimum TLS version for Access Server web services using the Admin Web UI or command-line interface.
---

# Tutorial: Select the SSL and TLS Levels on the Web Server

## Overview

You can adjust the TLS settings for the Access Server web server from the Admin Web UI or command-line interface (CLI).

### Default TLS settings by version

| **Scenario** | **Default minimum TLS version** |
| --- | --- |
| New installation on Access Server 3.2.0 or newer | TLS 1.3 |
| Upgrade from Access Server 3.1.x or earlier | Retains previous setting (TLS 1.2 unless manually changed) |
| New installation on Access Server 2.1.12-3.1.x | TLS 1.2 |

> **Important**
>
> The OpenSSL library insalled on your Access Server's operating system needs to support the selected TLS version. On older operating systems, OpenSSL may not support TLS 1.3. On newer operating systems, OpenSSL automatically upgrades TLs 1.0 and 1.1 connections o TLS 1.2.

## Prerequisites

- An installed Access Server.
- Admin Web UI access or console access with root privileges.

## Option 1: Adjust the TLS level from the Admin Web UI

1. Sign in to the Admin Web UI.
2. Select **Configuration → TLS Settings**.
3. Scroll down to **TLS options for Web Server**.
4. Select your desired protocol version (the default is TLS 1.2).
5. Select **Save Settings** and **Update Running Server**.

   > **Important**
   >
   > When you change the TLS level, this requires restarting the server.

## Option 2: Adjust the TLS level from the CLI

1. Connect to the console and get root privileges.
2. List the current TLS level:

   ```
   sacli ConfigQuery | grep -i "cs.tls_version_min"
   ```

   - If nothing is displayed, the **cs.tls\_version\_min** configuration key uses the default value. See the defaults table above for the default value that applies to your installation.
3. Set the minimum TLS version. Valid values are `1.0`, `1.1`, `1.2`, and `1.3`:

   ```
   sacli --key "cs.tls_version_min" --value "1.2" ConfigPut
   sacli start
   ```
4. To reset the minimum TLS level to default, delete the configuration keys:

   ```
   sacli --key "cs.tls_version_min" ConfigDel
   sacli --key "ssl_api.tls_version_min" ConfigDel
   sacli start
   ```

---

Prev: [Tutorial: Set the Interface and Ports for the Web Services](https://openvpn.net/as-docs/tutorials/tutorial--web-services-interface-and-ports.md)
Next: [Tutorial: Specify Custom HTTP Headers](https://openvpn.net/as-docs/tutorials/tutorial--custom-http-headers.md)
Index: https://openvpn.net/as-docs/llms.txt