What we check/Certificate & HTTPSTL-04

Your server still accepts TLS 1.0 or 1.1

Both were retired by every major browser in 2020–21.

Area

Certificate & HTTPS

Check

TL-04

Included

Free in every scan

What we check

We completed a handshake with your server using an obsolete protocol version.

Why it matters

An attacker who can influence the connection can force it down to the weakest version both ends accept.

Supporting an old version for the benefit of a few old clients weakens the connection for everyone else.

The versions are also structurally weak rather than merely old — both have known problems in how they construct and verify records, which is why browsers removed them within a single twelve-month window rather than deprecating them slowly.

How to fix it

1. 1

   Restrict your server or CDN to TLS 1.2 and 1.3.

2. 2

   Restrict the origin as well as the edge if you use a CDN: a direct connection to the origin bypasses the edge’s settings entirely.

3. 3

   Restrict the origin as well as the edge if you use a CDN: a direct connection to the origin bypasses the edge’s settings entirely.

4. 4

   Then re-test from outside. Some load balancers keep a separate protocol list the server config does not touch.

nginx:   ssl_protocols TLSv1.2 TLSv1.3;
Apache:  SSLProtocol -all +TLSv1.2 +TLSv1.3

Common questions

Who will this break?

Windows 7 with an unpatched browser, and some embedded devices. Everything current has supported TLS 1.2 for over a decade.

I am behind a CDN.

Then it is a setting in the CDN dashboard, not a config file — and your origin should be restricted too.

Is TLS 1.2 still fine?

Yes. Enable 1.3 alongside it for the speed, but 1.2 is not the problem here.