Firstly, you need to you have TLSv1.1 & V1.2 support in OpenSSL - with your v1.0.1j, you do.
Next, is Apache V2.2.24 (or later) support for configuration items relating to SSL. In particular, to specify anything later than TLS1 (i.e. TLSv1.1 TLSv1.2) you need that later version. You have 2.4.4, so that should be okay.
Next, there is an "interaction" between the Apache configuration parameters: SSLProtocol
and SSLCipherSuite
.
So for your desired configuration, TLSv1.1 & TLSv1.2, you'd need something like:
SSLProtocol=All -SSLv2 -SSLV3 -TLSv1
SSLCipherSuite HIGH:!aNULL:!MD5:!RC4
I appreciate you have a more specific cipher suite list:
EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4
However, when I checked with my openssl (v1.0.1 stream) I found the following pre-TLSv1.2 suites were supported:
openssl ciphers -s -v 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4'
ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
DHE-RSA-SEED-SHA SSLv3 Kx=DH Au=RSA Enc=SEED(128) Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1
Then checking here (section A.5), https://www.rfc-editor.org/rfc/rfc4346 I don't think any of the supported suites listed by my openssl are actually TLSv1.1 valid, so you'd only end up with TLSv1.2, when tested (say at Qualys https://www.ssllabs.com/ssltest/).
Lastly, there's the whole issue of client support - the Qualys link above is handy as it lists which type of client (down to specific Android versions, for example) would be able to connect to the submitted test server). As you are quite cipher specific, I think you're not going to risk too much by allowing TLSv1 (for which read v1.0) as well as V1.1 & V1.2, unless you know you visitor base will not include TLSv1 only capable clients.