tls_advanced.protocols Reviewed July 2026

Quick fix

Measure legitimate client requirements before disabling legacy protocols.

What this finding means

SecuTest performs ordinary SNI-enabled handshakes for specific protocol versions. A protocol is reported as accepted only when the server actually negotiates it; local OpenSSL limitations remain separate.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Support for TLS 1.0 or TLS 1.1 exposes clients to obsolete protocol behavior and may violate modern security baselines.

Step-by-step fix

Where to make the change

  • The public TLS termination point: CDN, load balancer, reverse proxy, ingress controller, or web server.
  • The origin server only when it terminates the externally observed TLS connection.

Remediation procedure

  1. Measure legitimate client requirements before disabling legacy protocols.
  2. Disable TLS 1.0 and TLS 1.1 at the public load balancer, reverse proxy, and origin.
  3. Keep TLS 1.2 and TLS 1.3 enabled with modern configurations.
  4. Update monitoring and client documentation for any compatibility impact.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Test TLS 1.2
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null

Test TLS 1.3
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null

Verify the fix

  1. Run: openssl s_client -connect example.com:443 -servername example.com -tls1
  2. Repeat with -tls1_1 and confirm negotiation fails.
  3. Confirm TLS 1.2 and TLS 1.3 still succeed.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Changing only the origin while the CDN still accepts legacy TLS.
  • Disabling TLS 1.2 before client support for TLS 1.3 is universal.
  • Confusing local OpenSSL policy with server rejection.

Authoritative references