Outdated TLS versions (TLS 1.0/1.1)

Which protocol versions the server still accepts. TLS 1.0 and 1.1 are withdrawn and refused by every browser; a version this client itself would not speak is left out rather than guessed at.

• Help center

TLS is the protocol under HTTPS, and it has had several versions. TLS 1.0 and 1.1 were formally withdrawn by RFC 8996 in 2021: every major browser has dropped them, and payment-card audits (PCI DSS) fail on them. TLS 1.2 is the safe baseline, and TLS 1.3 is the current version, with a faster handshake and only modern ciphers.

How SiteScan checks it

Besides the normal connection, the scanner tries separate handshakes pinned to TLS 1.0 and to TLS 1.1. If the server completes either one, this row appears in red and names the legacy versions it accepted. If neither succeeds, the row is left out: a refusal may come from the scanner's own TLS library rather than from your server, so it is not reported as proof. The version actually in use is shown as a fact under Technology.

How to fix

Allow only modern versions:

• nginx: ssl_protocols TLSv1.2 TLSv1.3;
• Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3
• Behind a CDN or load balancer, set the minimum TLS version to 1.2 in its settings; the origin's config does not apply there.

Clients that can only speak TLS 1.0 are too old for current browsers anyway, so nobody real is locked out. Run a new scan afterwards to confirm the row is gone.