TLS / HTTPS · Check
TLS 1.0 / TLS 1.1 still offered — disabling legacy protocols
TLS 1.0 and 1.1 are formally deprecated by the IETF (RFC 8996) because they're tied to weak ciphers and have known protocol-level weaknesses (BEAST, padding oracle attacks). Modern browsers no longer use them, so leaving them enabled exists only as a downgrade target for attackers on hostile networks.
Why it matters
Disabling them at your TLS terminator (load balancer, CDN, or web server) is a one-line config change with effectively zero compatibility impact in 2024+ — the only clients that needed them haven't been supported for years.
Real-world risk
TLS 1.0/1.1 have known protocol weaknesses; downgrade-capable networks may force weaker sessions.
Fix steps (in order)
- Disable TLS 1.0 and 1.1 at your load balancer or CDN; require TLS 1.2+.
- Retest with: openssl s_client -connect host:443 -tls1 (should fail once disabled).
Topic explainer
TLS versions explained: 1.0, 1.1, 1.2, 1.3 and what to disable →
What's actually different between TLS 1.0, 1.1, 1.2, and 1.3 — cipher suites, forward secrecy, performance — and which versions to disable for compliance and security.
Verify the fix in 30 seconds
Run a Scorifya scan on the affected host after deploy. The same finding id (tls_legacy_protocol_offered) clears once the externally-observable signal is in place.