Based on https://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslprotocol:
All
This is a shortcut for "+SSLv2 +SSLv3 +TLSv1" or - when using OpenSSL 1.0.1 and later - "+SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2", respectively.
So first, there would be a need to know which OpenSSL version you use.
Let us rewrite your statements:
1) before OpenSSL 1.0.1:
SSLProtocol all -SSLv2 -SSLv3
becomes
SSLProtocol +SSLv2 +SSLv3 +TLSv1 -SSLv2 -SSLv3
which should probably mean
SSLProtocol +TLSv1
2) after OpenSSL 1.0.1
then it becomes with the same reasoning
SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
The other directive you have is:
SSLProtocol TLSv1.1 TLSv1.2 -SSLv2 -SSLv3
This directive does not say anything about TLSv1 (which is 1.0 in fact)
so the two statements are not equivalent.
One allows TLS 1.0 (the SSLProtocol all -SSLv2 -SSLv3
) where the other (SSLProtocol TLSv1.1 TLSv1.2 -SSLv2 -SSLv3
) allows only TLS 1.1 and 1.2
Hence, a client supporting at most TLS 1.0 will be able to connect to first case, not to second one.
But like I said in my comment, you are not describing in details what was the client problem. TLS handshake details would be needed, both from his side and from Apache logfiles.
You can emulate connections by using something like openssl s_client
and providing specific flags to force the TLS version and see if the webserver replies. Or a tool like https://testssl.sh/ or analyze-ssl.pl
at https://github.com/noxxi/p5-ssl-tools
Final notes:
- nowadays, except for very good reason (like a client that you can absolutely not update), you should enable only 1.2 (or later). Various references and norms go into this direction, both at government levels, industry guidelines (like PCI-DSS), or technical standards (like at the IETF)
- the above is only a best guess, as there may still be a default list of versions, either in Apache or in openssl, that can come into mix, and may make a difference between saying
+TLSv1.2
vs just TLSv1.2
(first case you add the value to an existing default list, second case you may just replace current default list by only one value).
openssl s_client
?