Hm. I'm not sure: I think since APR-Version 1.1.32 it should be possible to do a combination of TLSv1+TLSv1.1+TLSv1.2. It is recommended here http://wiki.apache.org/tomcat/Security/POODLE (see Section "APR-based connector (Apr)") and here http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html (see Section "Edit the Tomcat Configuration File" -> <Connector> Example #2: APR based Connectors)