Web Protocols

TLS 1.2

The previous TLS version — still secure when configured with modern AEAD ciphers and forward secrecy, but slower than 1.3 and burdened with many insecure options that must be disabled.

What it is

TLS 1.2 (RFC 5246) is still trusted and ubiquitous, but its safety depends entirely on configuration. It offers both strong AEAD ciphers (AES-GCM, ChaCha20-Poly1305 with ECDHE for forward secrecy) and long-obsolete ones (RC4, 3DES, CBC with SHA-1) that must be disabled. Its handshake takes two round trips versus TLS 1.3's one.

Why it matters

  • It remains a necessary fallback for older clients that do not speak TLS 1.3.
  • Its wide menu of ciphers means a careless config can be insecure while still 'using TLS'.

Common mistakes

  • Leaving weak ciphers (RC4, 3DES, CBC-SHA1) enabled for compatibility.
  • Not prioritising ECDHE suites, losing forward secrecy.

How WebInspect checks this

  • WebInspect reports the TLS version and cipher and flags weak or deprecated cipher suites.