I try to enable TLSv1 and TLSv1.1 for one specific ingress on a AKS cluster.

By default, only TLSv1.2 is enabled.

I don't want to apply this configuration on my all cluster, just on a specific webserver service.

Regarding the documentation, I need to add this annotation if I don't want to change nginx config by ConfigMap :

nginx.ingress.kubernetes.io/proxy-ssl-protocols: TLSv1 TLSv1.1 TLSv1.2

but this has no effect.

Is it really possible to do this by annotation ?

Did I do something wrong ?

Thank you !

  • Which image/tag of the ingress controller are you using? Commented Apr 12, 2021 at 18:08
  • @EduardoBaitello I use this one : gcr.io/jenkinsxio/nginx-ingress-controller:0.30.0 Thanks for your reply !
    – benCat
    Commented Apr 14, 2021 at 7:41

1 Answer 1


The ConfigMap and Annotation configuration have different purposes.

As per nginx-configuration/configmap/#ssl-protocols:

Sets the SSL protocols to use. The default is: TLSv1.2 TLSv1.3

Context: http, server

i.e., enable the specified protocols to your Nginx Controller.

client --ssl-protocols-> controller --> backend

On nginx-configuration/annotations/#backend-certificate-authentication, we can read:

Enables the specified protocols for requests to a proxied HTTPS server.

ngx_http_proxy_module.html#proxy_ssl_protocols http, server, location

i.e., enables the specified protocols for requests to a proxied backend using HTTPS.

client --> controller --proxy-ssl-protocols-> backend

As you can see, to set the protocols served by your Nginx controller, you only have http, server contexts available (i.e., you can't set this to specific ingress objects).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.