Deprecating TLS 1.0 and 1.1 on NuGet.org – Stage 1

The NuGet Team

February 12th, 2020

Last November, we shared our two-stage plan for deprecating TLS 1.0/1.1 on NuGet.org and actions you can take today to ensure your systems use TLS 1.2. In this post, we will go into more details and a specific timeline for Stage 1 i.e. temporarily removing support for TLS 1.0/1.1 on NuGet.org. The goal is to help you identify systems that may be affected and will give you an opportunity to take action before we permanently remove support for TLS 1.0/1.1 in April 2020.

NuGet.org will temporarily remove support for TLS 1.0/1.1 on February 26, 2020

We plan to temporarily remove support for TLS 1.0/1.1 across 3 time slots in a 24 hour period, for 4 hours each, to ensure overlap with normal working hours across the globe. If you discover that you are impacted and cannot identify a workaround, please open an issue on the NuGet Gallery GitHub repo.

Refer to the table below to identify the test slot time in your time zone.

For example – if you live in Australia and follow ACST i.e. UTC+9.5, you should target the Blue test slot which translates to 9:30 AM to 1:30 PM ACST. Note that the other tests might spill into non-target hours of your time zone. Continuing with the same example, ACST (UTC+9.5) will also see outages during non-target hours of 5:30 PM and 9:30 PM on February 26, and between 1:30 AM and 5:30 AM on February 27.

Feedback

We are on track to remove support for TLS 1.0/1.1 in April 2020 and want to make this transition as smooth as we can. If you run into any issues in this process, please open an issue on the NuGet Gallery GitHub repo or email support@nuget.org.