TLS Protocol Version

TLS Protocol Version checks the negotiated TLS version on each primary HTTPS host. TLS 1.2 has been the safe minimum for years; TLS 1.3 (RFC 8446) is the modern default and removes a lot of the legacy footguns from earlier versions. TLS 1.0 and 1.1 are deprecated by every major browser and by PCI DSS, and serving them exposes legitimate users to downgrade attacks even when no one in the wild needs them anymore.

How the check works

RedScore performs a verified TLS handshake to each primary HTTPS host and records the negotiated protocol version. Points awarded by version:

• TLS 1.3: 15/15 pts.
• TLS 1.2: 15/15 pts (TLS 1.2 is the floor; either modern version gets full credit).
• TLS 1.1, TLS 1.0, SSLv3, SSLv2: 0/15 pts. The host is also flagged as critical_tls in the parent rollup.
• Unknown or unrecognized version string: 6/15 pts (conservative fallback).
• Not HTTPS, or TLS handshake failed: 0/15 pts.

Note: the score reflects the version your server NEGOTIATED with the scanner, not every version it accepts. If your server supports both TLS 1.2 and TLS 1.0 and the scanner negotiated 1.2, you score 15 here, but old clients that only speak TLS 1.0 still connect (and your real users on legacy clients are at risk). Disable old versions explicitly; do not rely on negotiation.

How the verdict maps to evidence

• Pass (15/15 per host): TLS 1.2 or TLS 1.3 negotiated.
• Partial (6/15 per host): version string was unparseable. Rare; usually a non-standard server response.
• Fail (0/15 per host): TLS 1.1 or older negotiated, or TLS handshake failed entirely.

Fix: disable TLS 1.0 and 1.1, support 1.2 and 1.3

Most modern web servers and CDNs default to TLS 1.2/1.3 with TLS 1.0/1.1 disabled. If you are scoring 0 here, you are either running old defaults or have explicitly enabled legacy versions. The fix is per-platform configuration.

Cloudflare

SSL/TLS → Edge Certificates → Minimum TLS Version. Set to TLS 1.2 (or TLS 1.3 to require it). Cloudflare also exposes "TLS 1.3" as a separate toggle that should be On.

AWS CloudFront

On the distribution: Settings → Security policy. Choose TLSv1.2_2021 (latest minimum-1.2 policy) or TLSv1.3 (1.3-only). Older policies (TLSv1, TLSv1.1_2016) need to be replaced.

AWS ALB and NLB

On the listener: Security policy. Choose ELBSecurityPolicy-TLS13-1-2-2021-06 or ELBSecurityPolicy-TLS13-1-3-2021-06. Both meet the floor.

Fastly

Configure → Domains → TLS Configurations. Set TLS protocol minimum to 1.2.

nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
# Mozilla SSL Configuration Generator (Intermediate profile) gives the
# matching ssl_ciphers list and dhparam recommendations.

Apache (mod_ssl)

SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLHonorCipherOrder off
SSLSessionTickets off
# Mozilla SSL Configuration Generator (Intermediate profile) gives the
# matching SSLCipherSuite line.

Caddy

Caddy ships with TLS 1.2 minimum by default and supports TLS 1.3. No configuration needed unless you have explicitly relaxed the floor.

Mozilla SSL Configuration Generator

ssl-config.mozilla.org generates ready-to-paste configuration for nginx, Apache, HAProxy, AWS ELB, and others, in three profiles: Modern (TLS 1.3 only, breaks pre-2018 clients), Intermediate (TLS 1.2+, broad compatibility, recommended for most sites), and Old (TLS 1.0+, only if you must support pre-2014 clients). Pick Intermediate unless you have a specific reason.

Verify the fix

• openssl s_client -connect yourdomain.tld:443 -servername yourdomain.tld -tls1_2 < /dev/null. Should connect successfully.
• openssl s_client -connect yourdomain.tld:443 -servername yourdomain.tld -tls1_3 < /dev/null. Should connect if TLS 1.3 is enabled.
• openssl s_client -connect yourdomain.tld:443 -servername yourdomain.tld -tls1 < /dev/null. Should FAIL (handshake failure or alert).
• openssl s_client -connect yourdomain.tld:443 -servername yourdomain.tld -tls1_1 < /dev/null. Should also FAIL.
• ssllabs.com/ssltest gives a full TLS audit including which versions are accepted, cipher list, cert chain, and client compatibility matrix.
• Re-run the RedScore lookup. Pass requires TLS 1.2 or 1.3 negotiated on every primary HTTPS host.

Common pitfalls

• Server still accepts old TLS after disabling. Reload or restart the server after configuration changes; some servers cache TLS settings until restart.
• TLS 1.3 enabled but clients negotiate 1.2. Not a bug. Older clients (Java 8 without updates, very old curl, some IoT devices) cannot speak 1.3 and negotiate down. As long as 1.0/1.1 are disabled, this is fine.
• CDN minimum set high, origin still accepts old TLS. The CDN protects external traffic, but your origin firewall should also accept only modern TLS in case anyone bypasses the CDN. Apply the floor at both layers.
• Compliance frameworks differ. PCI DSS requires TLS 1.2 minimum for cardholder data; HIPAA, FedRAMP, and others have their own thresholds. The Mozilla Modern profile (TLS 1.3 only) is overkill for most compliance regimes; Intermediate (TLS 1.2+) hits all common requirements.
• Self-signed or expired certs do not change this sub-weight, but they tank Certificate Validity and Chain Completeness. Fix them in those checks.
• TLS handshake failure on the scanner. If the scanner cannot complete a TLS handshake at all, this check returns 0 even if your TLS version is fine. Fix Web Assessability first.