Weak TLS Version

What it means

During the TLS handshake, this server negotiated an outdated protocol version — SSLv2, SSLv3, TLS 1.0, or TLS 1.1 — instead of TLS 1.2 or newer. See the linked guide below for what separates these versions and why the older ones are considered weak.

Why it matters

TLS 1.0 and 1.1 predate cryptographic protections built into later versions and were formally deprecated by major browsers in 2020; PCI DSS has required disabling them for payment-handling systems since 2018. A server that still negotiates one of these versions is running a protocol its own ecosystem no longer considers acceptable, independent of whether the certificate itself is valid.

What Nivaronix checks

Nivaronix records the protocol version actually negotiated during a normal TLS handshake — the same negotiation a browser performs — and flags it if the server still allows SSLv2, SSLv3, TLS 1.0, or TLS 1.1. This is a protocol-version check, not a scan for exploitable vulnerabilities.

Example evidence

Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.

Illustrative example only — not a live scan result.

URL: https://example.com
Negotiated protocol: TLSv1.0
Status: WEAK TLS VERSION

How to fix it

• Upgrade to TLS 1.2 or higher.
• Configure the server (or load balancer/CDN terminating TLS) to disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1, and enable TLS 1.2 at minimum — TLS 1.3 where supported.
• After disabling old versions, test any legacy integrations (older mobile app versions, embedded devices, internal services) that might still depend on TLS 1.0/1.1 before assuming nothing will break.

How to verify the fix

Re-run the SSL/TLS checker against the domain and confirm the negotiated version is now TLS 1.2 or 1.3. `openssl s_client -connect hostname:443 -tls1` (or `-tls1_1`) should now fail to connect at all.