diff --git a/camel/camel-tcp-stream-ssl.c b/camel/camel-tcp-stream-ssl.c
index 41f9936..e738c1f 100644
--- a/camel/camel-tcp-stream-ssl.c
+++ b/camel/camel-tcp-stream-ssl.c
@@ -48,6 +48,8 @@
 #include <sslerr.h>
 #include "nss.h"    /* Don't use <> here or it will include the system nss.h instead */
 #include <ssl.h>
+#include <sslt.h>
+#include <sslproto.h>
 #include <cert.h>
 #include <certdb.h>
 #include <pk11func.h>
@@ -170,6 +172,7 @@ camel_tcp_stream_ssl_get_type (void)
  * #CAMEL_TCP_STREAM_SSL_ENABLE_SSL2,
  * #CAMEL_TCP_STREAM_SSL_ENABLE_SSL3 or
  * #CAMEL_TCP_STREAM_SSL_ENABLE_TLS
+ * Regardless of what these are set to, TLS will be used.
  *
  * Since the SSL certificate authenticator may need to prompt the
  * user, a #CamelSession is needed. @expected_host is needed as a
@@ -203,6 +206,7 @@ camel_tcp_stream_ssl_new (CamelSession *session, const gchar *expected_host, gui
  * #CAMEL_TCP_STREAM_SSL_ENABLE_SSL2,
  * #CAMEL_TCP_STREAM_SSL_ENABLE_SSL3 or
  * #CAMEL_TCP_STREAM_SSL_ENABLE_TLS
+ * Regardless of what these are set to, TLS will be used.
  *
  * Since the SSL certificate authenticator may need to prompt the
  * user, a CamelSession is needed. @expected_host is needed as a
@@ -1040,6 +1044,9 @@ static PRFileDesc *
 enable_ssl (CamelTcpStreamSSL *ssl, PRFileDesc *fd)
 {
 	PRFileDesc *ssl_fd;
+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
+	SSLVersionRange versionStream;
+#endif
 
 	ssl_fd = SSL_ImportFD (NULL, fd ? fd : ssl->priv->sockfd);
 	if (!ssl_fd)
@@ -1047,24 +1054,17 @@ enable_ssl (CamelTcpStreamSSL *ssl, PRFileDesc *fd)
 
 	SSL_OptionSet (ssl_fd, SSL_SECURITY, PR_TRUE);
 
-	if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_SSL2) {
-		SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL2, PR_TRUE);
-		SSL_OptionSet (ssl_fd, SSL_V2_COMPATIBLE_HELLO, PR_TRUE);
-	} else {
-		SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL2, PR_FALSE);
-		SSL_OptionSet (ssl_fd, SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
-	}
-
-	if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_SSL3)
-		SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL3, PR_TRUE);
-	else
-		SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL3, PR_FALSE);
-
-	if (ssl->priv->flags & CAMEL_TCP_STREAM_SSL_ENABLE_TLS)
-		SSL_OptionSet (ssl_fd, SSL_ENABLE_TLS, PR_TRUE);
-	else
-		SSL_OptionSet (ssl_fd, SSL_ENABLE_TLS, PR_FALSE);
+	SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL2, PR_FALSE);
+	SSL_OptionSet (ssl_fd, SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
+	SSL_OptionSet (ssl_fd, SSL_ENABLE_SSL3, PR_FALSE);
 
+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
+	SSL_VersionRangeGetSupported (ssl_variant_stream, &versionStream);
+	versionStream.min = SSL_LIBRARY_VERSION_TLS_1_0;
+	SSL_VersionRangeSet (ssl_fd, &versionStream);
+#else
+	SSL_OptionSet (ssl_fd, SSL_ENABLE_TLS, PR_TRUE);
+#endif
 	SSL_SetURL (ssl_fd, ssl->priv->expected_host);
 
  	/* NSS provides a default implementation for the SSL_GetClientAuthDataHook callback
diff --git a/camel/camel.c b/camel/camel.c
index 7f6eeb0..6b55015 100644
--- a/camel/camel.c
+++ b/camel/camel.c
@@ -32,6 +32,8 @@
 #include <prthread.h>
 #include "nss.h"      /* Don't use <> here or it will include the system nss.h instead */
 #include <ssl.h>
+#include <sslt.h>
+#include <sslproto.h>
 #endif /* HAVE_NSS */
 
 #include <glib.h>
@@ -82,6 +84,9 @@ camel_init (const gchar *configdir, gboolean nss_init)
 	if (nss_init) {
 		gchar *nss_configdir;
 		PRUint16 indx;
+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
+		SSLVersionRange versionStream;
+#endif
 
 		if (nss_initlock == NULL) {
 			PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 10);
@@ -124,10 +129,18 @@ camel_init (const gchar *configdir, gboolean nss_init)
 				SSL_CipherPrefSetDefault (SSL_ImplementedCiphers[indx], PR_TRUE);
 		}
 
-		SSL_OptionSetDefault (SSL_ENABLE_SSL2, PR_TRUE);
-		SSL_OptionSetDefault (SSL_ENABLE_SSL3, PR_TRUE);
-		SSL_OptionSetDefault (SSL_ENABLE_TLS, PR_TRUE);
-		SSL_OptionSetDefault (SSL_V2_COMPATIBLE_HELLO, PR_TRUE /* maybe? */);
+		SSL_OptionSetDefault (SSL_ENABLE_SSL2, PR_FALSE);
+		SSL_OptionSetDefault (SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
+		SSL_OptionSetDefault (SSL_ENABLE_SSL3, PR_FALSE);
+
+#if NSS_VMAJOR > 3 || (NSS_VMAJOR == 3 && NSS_VMINOR >= 14)
+		/* Enable all TLS versions supported by NSS (this API is for SSLv3 and newer). */
+		SSL_VersionRangeGetSupported (ssl_variant_stream, &versionStream);
+		versionStream.min = SSL_LIBRARY_VERSION_TLS_1_0;
+		SSL_VersionRangeSetDefault (ssl_variant_stream, &versionStream);
+#else
+		SSL_OptionSetDefault (SSL_ENABLE_TLS, PR_TRUE);  /* Enable TLSv1.0 */
+#endif
 
 		g_free (nss_configdir);
 	}
