SEC-039
Old TLS 1.0 or 1.1 still accepted
LowDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
A handshake-only connection at TLS 1.0 and at TLS 1.1. Only a completed handshake counts.
Why it matters
TLS 1.0 and 1.1 have known weaknesses, were retired by RFC 8996 and fail PCI DSS. Modern browsers no longer use them, so they only help old or malicious clients.
Recommended fix
Set the minimum TLS version to 1.2 at your host or CDN.
How to verify
Run `openssl s_client -connect <host>:443 -tls1_1` and confirm the handshake fails.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-039: Old TLS 1.0 or 1.1 still accepted
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Set the minimum TLS version to 1.2 for the production domain (hosting, CDN or load balancer setting) and confirm TLS 1.2 and 1.3 still work.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Run `openssl s_client -connect <host>:443 -tls1_1` and confirm the handshake fails.