Today I started receiving the following exception when making callouts to external web services:

System.CalloutException: IO Exception: Server chose TLSv1, but that protocol version is not enabled or not supported by the client.

Why would this start failing?

When connecting to the same org using the Partner API from a client application that doesn't support TLS 1.1 or higher:

UNSUPPORTED_CLIENT: TLS 1.0 has been disabled in this organization. Please use TLS 1.1 or higher when connecting to Salesforce using https.

A POST request for Web-to-lead is intermittently coming back with:

400 Bad Request
StatusDescription: TLS 1.1 or higher required.


This corresponds to Salesforce disabling TLS 1.0. Pointing https://www.ssllabs.com/ssltest/ at the publicly accessible web services returns the following result:

TLS 1.1 and 1.2 support missing

As a short term fix while upgrading the web services to support newer versions of TLS, you might be able to deactivate the corresponding critical update:

Require TLS 1.1 or higher for HTTPS connections

Update Name

Require TLS 1.1 or higher for HTTPS connections

Update Summary

This update strengthens HTTPS connections to and from this organization by disabling the older TLS 1.0 protocol and requiring TLS 1.1 or higher in HTTPS connections.

  • Hi Daniel, We are getting the same error in our fsandbox. But this feature is not enabled in the sandbox. Apparently it cannot be seen in the fsandbox under critical updates. However the feature is currently disabled in the production – L Mudiyanse Jun 27 '16 at 4:02
  • 2
    @Lahiru The screenshot above doesn't show it, but I believe Sandbox orgs have now been auto activated for the TLS 1.1+ requirement. Production orgs still have some time to run until they also auto activate. – Daniel Ballinger Jun 27 '16 at 8:07
  • 1
    Contact SFDC support if you need a sandbox or two rolled back to TLS1.0. Don't take the initial "no" for an answer, keep pushing if you need it. They have rolled back a couple of sandboxes for me. – krigi Jul 8 '16 at 4:52

For anyone who found themselves with this issue and is running Mac Server, upgrading to El Capitan and to the latest Server.app (5.1?) solved all of these issues for me. It updated the version of openssl (no higher than 0.9.8xx on previous OS X versions) to 1.0.2g which can handle TLS1.1 and TLS1.2.

For me, it broke our acceptance of Outbound Messages and our use of the Salesforce REST API.

What's more, it allows hidden folders to be served, a plus if you want to set up let's encrypt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.