TLS Versions Explained: Why TLS 1.0/1.1 Are Weak and What 'Modern TLS' Means
Last updated August 9, 2026.
TLS is the protocol, the certificate is just one part of it
TLS (Transport Layer Security) is the protocol that negotiates encryption for a connection. The certificate is presented as part of that negotiation, but the protocol version itself — TLS 1.0 through 1.3 — determines which cryptographic algorithms and handshake behaviors are allowed, independent of whether the certificate is otherwise valid.
Why TLS 1.0 and 1.1 are considered weak
TLS 1.0 (1999) and TLS 1.1 (2006) predate a number of cryptographic attacks and no longer support the cipher suites and handshake protections built into later versions. Major browsers formally deprecated both in 2020, and PCI DSS has required disabling them for payment-handling systems since 2018. A server that still negotiates TLS 1.0/1.1 is not automatically breached by that fact alone, but it is running a protocol version its own ecosystem no longer considers acceptable.
What 'modern TLS' means
In practice, modern TLS means supporting TLS 1.2 at minimum and preferring TLS 1.3, while disabling TLS 1.0 and 1.1 at the server or load-balancer level. TLS 1.3, finalized in 2018, also simplifies the handshake and removes several legacy cipher options that were sources of past vulnerabilities.
How this shows up in a scan
A certificate and configuration checker looks at which protocol version a server actually negotiates during a normal TLS handshake — the same negotiation a browser performs — and flags it if the server still allows TLS 1.0 or 1.1, separately from whether the certificate itself is valid.
Check which TLS version your domain negotiates
The SSL/TLS checker flags TLS 1.0/1.1 alongside certificate expiry, hostname mismatch, and chain issues, and that result feeds directly into the overall security score for the domain.
Open the SSL/TLS checker