TLS 1.0 (1999) and TLS 1.1 (2006) are obsolete. All major browsers removed support in 2020, and the PCI-DSS standard has prohibited TLS 1.0 for card processing for years. Yet many servers still accept them for "compatibility," which quietly weakens security for everyone.
The problem
These versions rely on outdated cipher constructions vulnerable to attacks such as BEAST and POODLE, and they lack the authenticated-encryption modes that TLS 1.2 and 1.3 mandate. Leaving them enabled also lets an attacker attempt a downgrade, nudging a connection onto the weaker protocol.
What to do
- Configure your server to offer only TLS 1.2 and 1.3.
- On Apache:
SSLProtocol -all +TLSv1.2 +TLSv1.3. On Nginx:ssl_protocols TLSv1.2 TLSv1.3;. - Behind a CDN or load balancer, set the minimum TLS version in its dashboard.
- Re-test afterwards to confirm 1.0/1.1 now fail to negotiate.
Real-world traffic from clients that genuinely require TLS 1.0 is now negligible, so the compatibility cost is effectively zero while the security gain is real.