Legacy TLS version in use

Problem

The server still negotiates SSLv3, TLS 1.0 or TLS 1.1. These protocols are formally deprecated (RFC 8996) and vulnerable to known attacks (POODLE, BEAST, weak MACs).

Why it matters

• Modern browsers show security warnings or refuse to connect.
• PCI-DSS and most compliance regimes forbid TLS < 1.2.
• Search engines treat broken/insecure TLS as a crawlability problem: the page may drop out of the index.

How to fix

• Disable everything below TLS 1.2 on the server or load balancer:
• nginx: ssl_protocols TLSv1.2 TLSv1.3;
• Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3
• Renew the certificate chain if it uses SHA-1 signatures.
• Verify with openssl s_client or SSL Labs; the audit here re-checks on the next run.

Related: Upgrade TLS 1.2 to 1.3