Recently, we had a candidate for our free Security Check. Everything ran cleanly – until one point: the TLS/SSL assessment choked on this particular setup. No clean result, no completion. 3 weeks later we had our own tool: Gossling, a TLS/SSL scanner that fixes exactly this problem and completed that check in the process. Documented, ready to use – and free for everyone.
But first, let’s answer a question that keeps coming up: what does „SSL obsolete version” actually mean – and above all, what do you do about it?
What does the “SSL obsolete version” warning mean?
The message “SSL obsolete version” (or “obsolete connection settings”) means a server still accepts outdated encryption that is considered insecure – usually SSLv3, TLS 1.0 or TLS 1.1, or weak algorithms such as RC4, 3DES or SHA-1 certificates. Browsers show the notice to flag the security risk.
Only TLS 1.2 and TLS 1.3 are current and secure. Obsolete versions enable downgrade attacks (e.g. POODLE on SSLv3, BEAST on TLS 1.0) and cause findings in audits (ISO 27001, PCI DSS). The fix: disable old protocols server-side and allow only TLS 1.2/1.3 with strong cipher suites.
To check whether your server accepts obsolete SSL/TLS versions, use Gossling for free. For the full picture – mail security, security headers, open ports and a ready-to-work ToDo list – run the free Security Check by CheckFix.
Which SSL and TLS versions are considered obsolete?
Browsers like Chrome show the “obsolete connection settings” notice mostly when the server still accepts an old protocol version or a weak algorithm. Today, the following are considered obsolete:
| Protocol | Status | Reason |
|---|---|---|
| SSL 2.0 | prohibited | Serious design flaws (RFC 6176) |
| SSL 3.0 | deprecated | Vulnerable to POODLE (RFC 7568) |
| TLS 1.0 | obsolete | Weak crypto, BEAST (RFC 8996, 2021) |
| TLS 1.1 | obsolete | No modern cipher suites (RFC 8996, 2021) |
| TLS 1.2 | current | Secure when cleanly configured |
| TLS 1.3 | recommended | Most modern standard, fast and secure |
The PCI DSS standard has also required disabling TLS 1.0 since mid-2018. So if you see an “obsolete version” warning, you’re almost always dealing with SSLv3, TLS 1.0 or TLS 1.1 still being enabled – or with outdated algorithms like RC4, 3DES or SHA-1 certificates.
Why are obsolete TLS/SSL versions a security risk?
Encryption is only as strong as the weakest method it accepts. As long as your server still allows an old protocol version, an attacker may try to downgrade the connection to it – and exploit the weaknesses of the older version.
In practice that means:
- POODLE (SSLv3) and BEAST (TLS 1.0) allow decryption of traffic under certain conditions.
- Weak cipher suites open the door to man-in-the-middle attacks, where data in transit is read.
- Compliance risk: Obsolete versions cause findings in audits (ISO 27001, PCI DSS, NIS2-relevant assessments).
The tricky part: you can’t tell an obsolete TLS configuration just by looking at a website. It works, after all. Until someone looks closely – ideally you, in the worst case an attacker.
How do I find obsolete SSL/TLS versions?
Doing it manually is tedious: you’d have to test every protocol version and every cipher suite on every host individually. That’s why most people reach for tools. And that’s exactly where our problems began.
- SSL Labs (Qualys) delivers the grading everyone understands – but only for publicly reachable sites. You can’t check internal hosts, staging environments or air-gapped systems with it. And you depend on a shared, external queue.
- testssl.sh is deep, respected and battle-tested – but as a bash script it depends on the OpenSSL version and the shell environment. On certain targets it aborts, hangs or returns incomplete results. That’s exactly what happened with the candidate mentioned above.
We wanted the depth of testssl.sh, the clarity of SSL Labs grades, and the reliability of a platform we control ourselves. Gossling fills that gap.
What can Gossling do?
Gossling isn’t a script but a full TLS/SSL platform – a native Go scanner with an API, a web interface and scalable scan runners. Point it at a domain, an internal hostname or a STARTTLS mail server (smtp://, imap://), and results stream in live. You can use Gossling directly and for free at gossling.checkfix.io – no setup, just enter a target. If you also need to assess internal systems, you run Gossling in your own network via Docker.
In detail, Gossling checks, among other things:
- Protocols: SSLv2/3, TLS 1.0–1.3, downgrade and consistency checks
- Cipher suites: per-version enumeration, strength overview, server preference
- Certificates: chain validation, CT/SCT, OCSP stapling, Must-Staple, CAA, revocation
- Trust stores: Mozilla, Apple, Android, Java, Windows
- Vulnerabilities: Heartbleed, POODLE, ROBOT, DROWN, BEAST, CRIME, FREAK, Logjam, Sweet32, Ticketbleed, BREACH and more
- HTTP headers: HSTS (incl. preload eligibility), CSP, cookies, WAF fingerprint
The result is an A+ to F grade with a transparent breakdown – scoring uses SSL Labs weighting (protocol 30%, key exchange 30%, cipher strength 40%) and the cap logic of testssl.sh (e.g. Heartbleed → F, enabled TLS 1.0 → capped at B). Meaning: a single obsolete protocol version drags your overall grade down – exactly as it should.
For teams with larger infrastructure there’s also a REST API, WebSocket streaming, scan history, caching and a distributed runner fleet with its own VPN egress per worker. In short: a service you set up once and integrate everywhere – no browser tab, no shared queue.
Gossling vs. SSL Labs vs. testssl.sh
Staying honest is part of how we work – which is why Gossling is not a 1:1 clone of SSL Labs. Here’s the comparison:
| Gossling | SSL Labs | testssl.sh | |
|---|---|---|---|
| Form | Platform + CLI | Qualys cloud service | Bash CLI script |
| Target scope | Public hosts online, internal hosts when self-hosted | Public internet only | Any reachable host |
| Grading | A+–F (SSL Labs weights + testssl.sh caps) | A+–F (proprietary) | Findings + severity, no standard grade |
| Browser simulation | No | Yes | No |
| Automation | JSON API, WebSocket, CI tools | Rate-limited API | Shell/JSON output |
| Dependencies | Single Go binary | None (SaaS) | bash, OpenSSL, … |
What Gossling can’t (yet) do – to be fair:
- No browser/client handshake simulation like SSL Labs – this matters for some compatibility findings.
- The active padding-oracle tests (Zombie POODLE, Golden DOODLE) are deliberately opt-in, because they send additional manipulated handshakes.
- testssl.sh has years of community edge-case coverage behind it; Gossling is younger but compensates via ongoing regression tests against badssl.com and the SSL Labs API.
For everyday use that means: when testssl.sh aborts on a particular target, or you need to check a mail server that SSL Labs won’t touch at all, Gossling is built for exactly that.
More on this: Which other free TLS tools exist and which one you are allowed to use commercially is covered in our comparison Free SSL Labs Alternative: 8 Tools Compared. How to check your own configuration in about a minute is in the guide Test SSL/TLS online.
From scan to fix: what do I do with the results?
A scanner tells you what is wrong. The more interesting question is usually: what exactly do I do now?
That’s where CheckFix comes in. Gossling covers TLS/SSL – CheckFix is considerably more comprehensive and checks your entire external attack surface in one run:
- Mail Security (SPF, DKIM, DMARC)
- Secure Communication (TLS/SSL)
- Known Vulnerabilities (CVE matching)
- Security Headers
- Internet Interfaces (open ports, exposed services)
The free Security Check gives you the A-F rating across all five categories – the objective overview of where your company (or your client’s) currently stands. The decisive difference: with CheckFix you get the ToDo CheckList – prioritised tasks with step-by-step instructions, affected systems, IPs and domains. So you don’t have to interpret raw scanner output yourself; you simply work through the list.
The idea behind it: cybersecurity is not a one-time action. Whether it’s a simple check, a free scanner or a pentest – it should become part of daily business. And the best solutions emerge when people are passionate about the cause, not just the business.
How secure is your IT really?
An “SSL obsolete version” warning isn’t a cosmetic flaw but a concrete security risk. With Gossling you find obsolete protocols for free – and with the free Security Check by CheckFix you get the full picture plus the ToDo list to close them efficiently.