Enable TLS 1.3

Why it matters

TLS 1.3 is faster to connect and removes older, weaker options, and every current browser supports it. Your server only offers TLS 1.2, which is safe today but below the common modern baseline.

The fix

1. TLS 1.3 needs your TLS library to be OpenSSL 1.1.1 or later (or an equivalent), so update the web server and library if they are older.
2. Add TLS 1.3 to the allowed protocols in the web server, load balancer or CDN, then reload.
3. Keep TLS 1.2 enabled for older clients. Check with the command below that TLS 1.3 is now negotiated.

openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null 2>&1 | grep -E "Protocol|Cipher|error"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the TLS protocol versions check
• Turn off TLS 1.0 and 1.1
• Enable TLS 1.2 and TLS 1.3