TLS & certificates

TLS 1.1 disabled

Certificate validity and trust, key strength and protocol versions.

Why it matters

TLS 1.1 is deprecated (RFC 8996) and fails PCI DSS and most security baselines.

How to fix it

Quick fix · under 1 hour

Allow only TLS 1.2 and 1.3.
Reload the web server and re-run the scan to confirm.

nginx

ssl_protocols TLSv1.2 TLSv1.3;

Apache

SSLProtocol -all +TLSv1.2 +TLSv1.3

Test this now, free: SSL certificate checker - no sign-up.

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free