Back to scan results
What this check probes
For each of SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2, we attempt a handshake on port 443 advertising only that protocol. If the server completes the handshake, that version is reported as enabled. This .NET Framework scanner does not directly prove TLS 1.3 support in this check.
The same logic that nmap --script ssl-enum-ciphers or testssl.sh use — only narrower and faster, designed to fit in a public scanner without hammering your origin.
Why this matters for PCI DSS
PCI DSS v4.0 Requirement 4.2.1 requires strong cryptography on public networks carrying account data. SSL 3.0, TLS 1.0, and TLS 1.1 should all be disabled. For verdict calibration, PCIScan treats SSL 3.0 and TLS 1.0 as confirmed failures. TLS 1.1 remains deprecated and unsafe to leave enabled, but is shown as a warning because current CVSS-based ASV output may score standalone TLS 1.1 support below the PCI failure threshold.
- SSL 3.0 — POODLE (CVE-2014-3566) lets a network attacker decrypt cookies one byte at a time.
- TLS 1.0 — obsolete early TLS and a confirmed red result in this readiness scan.
- TLS 1.1 — deprecated and reported for remediation, but orange rather than red unless another independently failing TLS weakness is confirmed.
- TLS 1.2 — acceptable, but only with strong cipher suites and forward-secret key exchange.
- TLS 1.3 — recommended; removes legacy cipher modes and reduces handshake to one round trip.
How to fix it
nginx — in your server or http block:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
Apache (mod_ssl):
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE+AESGCM:ECDHE+CHACHA20
SSLHonorCipherOrder off
IIS / Windows Server — the easiest path is the free IIS Crypto tool from Nartac. Apply the "Best Practices" template and reboot. It edits the SCHANNEL keys under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
Verify your fix from the command line:
openssl s_client -connect example.com:443 -tls1
# expect: handshake failure
openssl s_client -connect example.com:443 -tls1_2
# expect: successful handshake
For a generated config tailored to your server and compatibility target, use the Mozilla SSL Configuration Generator.