Old TLS versions (1.0 / 1.1) are still accepted

SeverityMedium

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_tls_legacy

Short answer

Your server completes handshakes with TLS 1.0 or TLS 1.1, and possibly SSLv3 or SSLv2. Current browsers stopped using these versions in 2020 and RFC 8996 formally deprecated TLS 1.0 and 1.1 in 2021, so keeping them helps almost no real visitor while leaving weaker options available. Allow only TLS 1.2 and TLS 1.3.

Why it matters

The old versions depend on weak constructions (CBC padding schemes, MD5 and SHA-1 inside the handshake) that attacks such as POODLE (SSLv3) and BEAST (TLS 1.0) exploited. A client that still supports them can be pushed onto weaker settings, and standards such as PCI DSS require disabling them wherever card data is handled. There is no ranking effect; the risk is to connections from old or misconfigured clients and to the outcome of security audits.

How Glimana detects it

This check uses a deep TLS test: the open-source testssl.sh, run in handshake-only mode (it lists protocols and ciphers and runs no vulnerability exploits). It tries SSLv2, SSLv3, TLS 1.0 and TLS 1.1 against your hostname. If any of them is accepted, the check fails: medium for TLS 1.0 or 1.1, high if SSLv2 or SSLv3 is accepted. While the deep test is not available on the scanner, the check shows Not running yet; if the test could not finish for your site, Could not be measured.

How to fix it

Watch out

Think about clients that are not browsers before switching: Android 4.4 and older, embedded devices, and legacy payment, ERP or monitoring integrations that call your site. They lose access once TLS 1.0 and 1.1 are off. On Apache and Nginx set the protocol list globally, not in one virtual host only: when several sites share an IP address, the handshake can follow the default server's setting.

Find the finding in Glimana. Open Security; this check is in the Certificate and HTTPS group, with the evidence from the last scan under its title. The same problem is listed under Issues › Old TLS versions (1.0 / 1.1) are still accepted.
Apply the fix on your platform.

CloudflareNginxApachecPanel / shared hosting

SSL/TLS › Edge Certificates › Minimum TLS Version: choose TLS 1.2. This covers proxied (orange-cloud) records; DNS-only records still expose your origin server's own settings.

Put ssl_protocols TLSv1.2 TLSv1.3; in the http block so every server block inherits it, and remove or update any ssl_protocols line in individual server blocks that still lists TLSv1 or TLSv1.1. Then sudo nginx -t && sudo systemctl reload nginx.

In the global SSL configuration: SSLProtocol -all +TLSv1.2 +TLSv1.3. Find other SSLProtocol lines with grep -R SSLProtocol /etc/apache2 /etc/httpd 2>/dev/null, make them match, then reload Apache.

Server owners with WHM: Service Configuration › Apache Configuration › Global Configuration, remove TLS 1.0 and 1.1 from SSL/TLS Protocols and save. On shared hosting the setting belongs to the provider; ask support to disable TLS 1.0 and 1.1 for your site.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

Press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes when the check passes.