sh.itjust.works Main Community @sh.itjust.works xaera @sh.itjust.works 1y ago

Please stop using TLS v1.0 and 1.1

blog.qualys.com SSL Labs Grade Change for TLS 1.0 and TLS 1.1 Protocols | Qualys Security Blog

Update 1/31/2020: The grade change is now live on www.ssllabs.com. Servers that support TLS 1.0 or TLS 1.1 are capped to B grade. Update 1/16/2020: The grade change is now live on the development…

sh.itjust.works Main Community @sh.itjust.works xaera @sh.itjust.works 1y ago

Stop using TLS v1.0 or 1.1

blog.qualys.com /product-tech/2018/11/19/grade-change-for-tls-1-0-and-tls-1-1-protocols

8 2

5 comments

I'll take a look at our configs tomorrow 👍
- Were we outdated? I see we're using TLS 1.3 right now, and at least the certificate was last created/renewed before this post (created July 16, post on Aug 6). I know that's not really a metric, but my browser at least has the minimum TLS version set to 3, so I would absolutely have noticed if SJW used anything older.
  
  I guess it's possible we allowed older TLS versions, but at least the version I'm connecting with is completely fine.
What about TLS 1.2?
- Should still be good for now
  
  Not really, here's why:
  
  weak ciphers
  
  SCSV (protocol fallback)
  
  That's why I didn't go for that thankless job.