diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index c316d4870..c117504d6 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -241,6 +241,8 @@ func main() {
 			cert.Certificate = append(cert.Certificate, s.MetaCert())
 			return cert, nil
 		}
+		// Disable TLS 1.0 and 1.1, which are obsolete and have security issues.
+		httpsrv.TLSConfig.MinVersion = tls.VersionTLS12
 		httpsrv.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			if r.TLS != nil {
 				label := "unknown"