high SSL/TLS

Weak TLS Protocol Versions (TLS 1.0/1.1)

The server still accepts deprecated TLS 1.0 or TLS 1.1 connections, exposing visitors to downgrade and decryption attacks.

Severity

high

Time to Fix

30 minutes

Difficulty

medium

OWASP

A02:2021 — Cryptographic Failures

What is Weak TLS Protocol Versions (TLS 1.0/1.1)?

TLS 1.0 (1999) and TLS 1.1 (2006) were formally deprecated by the IETF in RFC 8996 and disabled by every major browser in 2020. These old protocols rely on weak primitives: CBC-mode cipher suites vulnerable to BEAST-style attacks, SHA-1 signatures, and predictable nonce construction that weakens record protection. Any server that still negotiates TLS 1.0 or 1.1 gives an active man-in-the-middle attacker a wider menu of downgrade and padding-oracle paths. PCI DSS has explicitly forbidden TLS 1.0 for new connections since 2018, and TLS 1.2 with AEAD ciphers has been the baseline ever since. Modern clients need nothing older than TLS 1.2 — and TLS 1.3 removes the legacy handshake entirely.

Why It Matters to Your Business

Keeping TLS 1.0/1.1 enabled fails PCI DSS 4.0 (Requirement 4.2.1 requires TLS 1.2+), shows up as a guaranteed finding in every compliance audit and penetration test, and exposes users on hostile networks to downgrade attacks. Security-conscious enterprise buyers increasingly run SSL Labs-style checks during vendor due diligence, and an obsolete protocol grade can cost deals. The risk is rarely exploited directly today, but it signals broader neglect — attackers and automated scanners treat weak TLS as a marker of an unmanaged estate.

How to Fix It

Allow only TLS 1.2 and 1.3 on every public endpoint:

Nginx (server block):
  ssl_protocols TLSv1.2 TLSv1.3;

Apache (VirtualHost or ssl.conf):
  SSLProtocol -all +TLSv1.2 +TLSv1.3

IIS (PowerShell, then restart):
  New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled -Value 0 -PropertyType DWORD
  New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Name Enabled -Value 0 -PropertyType DWORD

Cloudflare: SSL/TLS > Edge Certificates > Minimum TLS Version = 1.2.

After the change, verify externally (free scan on this page or: openssl s_client -connect yoursite.com:443 -tls1_1 must FAIL) and confirm monitoring/alerting still connects.

Frequently Asked Questions

Is TLS 1.1 still safe to use in 2026?

No. TLS 1.0 and 1.1 were deprecated by RFC 8996 in 2021, disabled in all major browsers in 2020, and violate PCI DSS. There is no legitimate reason to keep them enabled on a public site.

Will disabling TLS 1.0 break older clients?

Almost never. Every browser released since 2013 (and every current mobile OS, API client, and bot) supports TLS 1.2. Legacy Windows XP and Java 6 clients are the only real casualties — measure their traffic in analytics before worrying.

How do I check which TLS versions my site accepts?

Run a free scan on this page, or test manually: openssl s_client -connect yoursite.com:443 -tls1_1 should fail with a handshake error if TLS 1.1 is properly disabled.

Technical Classification

OWASP Category	A02:2021 — Cryptographic Failures
CWE ID	CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Detected By	ssl, ssl_labs, tls_cipher scanner(s)
Severity Level	high

How 2MNY Security Can Help

website hardening deep security audit

Check if your website has this vulnerability

Our ssl, ssl_labs, tls_cipher scanner checks for this issue automatically.

Scan My Website Free