Server accepts outdated or weak TLS configuration

What does this mean?

Your SSL certificate itself may be perfectly valid, but the server is still willing to negotiate an outdated protocol version (TLS 1.0 or 1.1, both deprecated industry-wide since 2021) or a weak cipher when a client asks for one. An attacker positioned between a visitor and your server can sometimes force this weaker connection deliberately, then exploit known cryptographic weaknesses in it — a class of attack broadly known as a protocol downgrade.

What are the potential impacts?

• An attacker positioned on the network path between a visitor and your server can sometimes force the connection down to an older, weaker protocol before exploiting known vulnerabilities in it — this is exactly the class of attack POODLE and BEAST specifically targeted.
• Compliance frameworks including PCI-DSS explicitly require disabling TLS 1.0/1.1 — accepting them can be a real problem if you ever handle payment data directly, even if no attack has happened yet.
• This typically doesn't affect the average visitor's everyday browsing, since modern browsers already prefer the strongest available protocol — the real risk is to anyone actively targeted by a network-level attacker, e.g. on public wifi or a compromised router.