diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index 82fbb3b12..d5f5faaf0 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -144,7 +144,7 @@
 #
 # [*ssl_options*]
 #  String that sets the default ssl options to force on all "bind" lines.
-#  Defaults to 'no-sslv3'
+#  Defaults to 'no-sslv3 no-tlsv10'
 #
 # [*ca_bundle*]
 #  Path to the CA bundle to be used for HAProxy to validate the certificates of
@@ -587,7 +587,7 @@ class tripleo::haproxy (
   $internal_certificates_specs = {},
   $enable_internal_tls         = hiera('enable_internal_tls', false),
   $ssl_cipher_suite            = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES',
-  $ssl_options                 = 'no-sslv3',
+  $ssl_options                 = 'no-sslv3 no-tlsv10',
   $ca_bundle                   = '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt',
   $crl_file                    = undef,
   $haproxy_stats_certificate   = undef,
diff --git a/releasenotes/notes/No-TLS-v1.0-0edeac680bb51f94.yaml b/releasenotes/notes/No-TLS-v1.0-0edeac680bb51f94.yaml
new file mode 100644
index 000000000..674b152f7
--- /dev/null
+++ b/releasenotes/notes/No-TLS-v1.0-0edeac680bb51f94.yaml
@@ -0,0 +1,4 @@
+---
+security:
+  - |
+    TLS v1.0 connections are no longer accepted by our HAProxy configuration.