Enable TLS 1.2 and TLS 1.3

Why it matters

The server accepts neither TLS 1.2 nor TLS 1.3, so current browsers cannot connect securely or at all. The software behind it is typically years out of date.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Identify the software terminating TLS (web server, load balancer, appliance or a CDN) and its version, together with the OpenSSL or TLS library it uses.
2. Stage 1, update that software and library. TLS 1.2 needs OpenSSL 1.0.1 or later and TLS 1.3 needs OpenSSL 1.1.1 or later. If the operating system is too old to update, plan a move to a supported release.
3. Stage 2, enable TLS 1.2 and 1.3 in the configuration and keep the old versions off.
4. A quick mitigation is to put a CDN or reverse proxy that supports modern TLS in front of the old server, and keep the legacy server reachable only from it.
5. Test with the commands below and keep the previous configuration so you can roll back.

openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null 2>&1 | grep -E "Protocol|Cipher|error"
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null 2>&1 | grep -E "Protocol|Cipher|error"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Turn off TLS 1.0 and 1.1
• Enable TLS 1.3