Web Protocols

TLS 1.0, TLS 1.1 & SSL (Deprecated)

The obsolete encryption protocols — SSL 2.0/3.0 and TLS 1.0/1.1 — broken by attacks like POODLE and BEAST. They must be disabled entirely; keeping them enabled is a serious vulnerability.

What it is

SSL 2.0/3.0 and TLS 1.0/1.1 are the early ancestors of modern TLS. All are deprecated: SSL 3.0 fell to POODLE, TLS 1.0 to BEAST and weak cipher constructions, and the IETF formally deprecated TLS 1.0 and 1.1 in RFC 8996 (2021). Every major browser has removed support.

Disable them

Serving TLS 1.0/1.1 or any SSL version exposes users to downgrade and decryption attacks and fails PCI-DSS. Configure servers to accept only TLS 1.2 and TLS 1.3.

Why it matters

  • Leaving them enabled is a real, exploitable vulnerability and a compliance failure.
  • They enable downgrade attacks even when newer TLS is available.

Common mistakes

  • Keeping TLS 1.0/1.1 enabled for a handful of legacy clients, exposing everyone to downgrade risk.
  • Confusing 'we use HTTPS' with 'we use secure TLS' — the version and ciphers decide security.

How WebInspect checks this

  • WebInspect flags any offered deprecated TLS/SSL version as a high-severity security issue.