Following on from my earlier post about increasing the security of HTTPS in Apache, I had a similar task with a website that’s running a node server.

The fix to disable TLS 1.0 and TLS 1.1 is fairly simple:

const httpsOptions = {
  ... other options ...
  secureOptions: require('constants').SSL_OP_NO_TLSv1 | require('constants').SSL_OP_NO_TLSv1_1,
};

httpsServer = https.createServer(httpsOptions, httpsApp);