TLS 1.3 is not enabled

SeverityLow

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_tls13_missing

Short answer

When Glimana connects, your server does not agree to TLS 1.3, the current version of the protocol (RFC 8446, 2018). TLS 1.2 is still acceptable, which is why this is low severity, but TLS 1.3 sets up a connection in one round trip instead of two and leaves out every legacy cipher by design. On most setups it is one line of configuration or a single toggle.

Why it matters

TLS 1.3 removes the features that attacks on older versions relied on (static RSA key exchange, CBC-mode ciphers, renegotiation, compression) and encrypts more of the handshake. Each new visitor connection also saves a round trip, which is noticeable on mobile networks. It does not change rankings; the gain is a slightly faster first connection and a smaller attack surface. Missing TLS 1.3 usually points to an outdated OpenSSL or web server build, which is worth updating for its own sake.

How Glimana detects it

Glimana opens a TLS connection to your hostname on port 443, offering TLS 1.3, and records the version your server chooses. The check passes if TLS 1.3 is negotiated, or if the deep TLS test (when it runs) reports TLS 1.3 as offered. Otherwise it is a low severity problem that shows the negotiated version. If no connection can be made, the result is Could not be measured. Behind a CDN, the result describes the CDN edge, not your origin server.

How to fix it

Watch out

Nginx needs to be built with OpenSSL 1.1.1 or later, Apache needs 2.4.37 or later with OpenSSL 1.1.1 or later. With an older build, listing TLSv1.3 in the configuration has no effect and the server keeps negotiating TLS 1.2. Confirm after the change with openssl s_client -connect example.com:443 -tls1_3 </dev/null.

Find the finding in Glimana. Open Security; this check is in the Certificate and HTTPS group, with the evidence from the last scan under its title. The same problem is listed under Issues › TLS 1.3 is not enabled.
Apply the fix on your platform.

CloudflareNginxApacheShared hosting

SSL/TLS › Edge Certificates › TLS 1.3: set it to On. It applies to visitor connections at Cloudflare's edge, which is what browsers and Glimana see on proxied (orange-cloud) records.

In the http block, or in every HTTPS server block: ssl_protocols TLSv1.2 TLSv1.3; then sudo nginx -t && sudo systemctl reload nginx. Check which OpenSSL your nginx was built with: nginx -V 2>&1 | grep -i openssl.

In the global SSL configuration (often ssl.conf): SSLProtocol -all +TLSv1.2 +TLSv1.3, then sudo apachectl configtest && sudo systemctl reload apache2 (the service is called httpd on RHEL-family systems).

On shared hosting the provider sets TLS versions for the whole server. Ask support to enable TLS 1.3; current LiteSpeed, Apache and Nginx builds support it. Putting the site behind a CDN such as Cloudflare is an alternative, since the CDN edge then handles visitor TLS.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

Press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes when the check passes.