Description
Using outdated SSL/TLS versions introduces multiple issues. These older protocol versions rely on deprecated encryption algorithms and insufficient key lengths that are vulnerable to cryptanalysis and brute-force attacks. In particular, SSLv2 and SSLv3 are notorious for a range of security weaknesses. Support for these obsolete protocols has been dropped by many modern software and platform vendors because they are considered insecure. As a result, websites and applications may no longer function properly or may fall short of current security standards. Certain industry regulations and standards—such as PCI DSS—require the use of specific TLS versions, typically TLS 1.2 or higher, to protect payment data.
Recommended Actions
Outdated TLS versions such as TLS 1.0 and 1.1, as well as their predecessors (SSLv2 and SSLv3), are susceptible to a wide range of security issues. It is recommended to use TLS 1.2 and TLS 1.3 exclusively and to disable deprecated SSL and TLS versions.
