Skip to content
DomainGrade

What we checkCertificate & HTTPSTL-04

TLS protocol versions

TLS 1.0 and 1.1 were retired in 2020–21. Accepting them lets a connection be downgraded.

Area
Certificate & HTTPS
Check
TL-04
Included
Free in every scan

What we check

We attempt a handshake restricted to the old protocol versions and report which, if any, your server accepts.

Why it matters

An attacker who can influence the connection can force it down to the weakest version both ends accept. Supporting an old one for the sake of old clients weakens it for everyone.

The clients that genuinely need TLS 1.0 are, at this point, mostly not clients you want.

There is no partial credit here. A server that accepts TLS 1.0 for the sake of one old client accepts it for everyone, including an attacker who would very much like the connection to use it.

The protocols themselves are not merely old. Both have structural weaknesses in how they construct and verify records, which is why every major browser removed them within the same twelve months rather than deprecating them gradually.

How to fix it

  1. 1

    Restrict your server to TLS 1.2 and 1.3.

  2. 2

    On a CDN this is usually a single setting rather than a config file.

Restricting protocol versions
nginx:   ssl_protocols TLSv1.2 TLSv1.3;
Apache:  SSLProtocol -all +TLSv1.2 +TLSv1.3

Common questions

Will this break old clients?
Windows 7 with an unpatched IE, and some embedded devices. Every current browser and OS has supported TLS 1.2 for over a decade.
Should I enable TLS 1.3?
Yes — it is faster and removes the weak options entirely. Keep 1.2 alongside it.
Do you test cipher suites?
Not individually. Restricting to 1.2 and 1.3 removes the genuinely broken ones, and a full cipher audit is a different kind of tool.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other certificate & https checks