TLS v1.0 and v1.1 disabled (only TLS 1.2+ allowed)What it checks and how to fix it

What it checks

Tries to complete a handshake with SSL 3.0, TLS 1.0 and TLS 1.1. If the server accepts any of them the check fails; if only TLS 1.2 and newer work, it passes. Sites not on HTTPS are skipped.

Why it matters

SSL 3.0, TLS 1.0 and TLS 1.1 have known weaknesses (POODLE, BEAST) and were formally deprecated in 2021 (RFC 8996). All major browsers dropped them in 2020, and PCI DSS forbids them for card data. Leaving them on adds risk without serving any real visitor.

How to fix it

Allow only TLS 1.2 and TLS 1.3.

nginx

ssl_protocols TLSv1.2 TLSv1.3;

Apache

SSLProtocol -all +TLSv1.2 +TLSv1.3

Cloudflare: SSL/TLS → Edge Certificates → Minimum TLS Version → TLS 1.2.

AWS ALB / CloudFront: pick a security policy such as ELBSecurityPolicy-TLS13-1-2-2021-06 or TLSv1.2_2021.

Rails: TLS is handled by whatever terminates HTTPS in front of the app (nginx, kamal-proxy, a load balancer), so change it there.

Verify:

openssl s_client -connect example.com:443 -tls1_1 </dev/null   # should fail