search

ssllabs / ssllabs-scan

A command-line reference-implementation client for SSL Labs APIs, designed for automated and/or bulk testing.
https://www.ssllabs.com/projects/ssllabs-apis/
Apache License 2.0
1.7k stars 241 forks source link

Setting TLS 1.3 as minumum TLS version yields a penalty for not supporting TLS 1.2 #930

Open rmjansen opened 1 year ago

rmjansen commented 1 year ago

Scanning a site with TLS 1.3 as the minimum required version results in an A. Lowering the minimum required TLS version to 1.2 (with no other changes applied) results in an A+ for the same site. This suggests that the penalty for using outdated TLS versions and not supporting TLS 1.2 is also applied to sites that use TLS 1.3 but not support TLS 1.2.

ArchangeGabriel commented 1 year ago

Duplicate: #910, #863, #853, #815, #786, #711. TL;DR: since FALLBACK can’t be tested, you can’t get A+. That’s silly, but the devs never acknowledged this.

lilyanatia commented 9 months ago

since FALLBACK can’t be tested, you can’t get A+. That’s silly, but the devs never acknowledged this.

it's especially silly since:

  1. downgrades aren't possible if the server only supports one TLS version.
  2. TLS 1.3 includes it's own downgrade prevention mechanism.
mulder999 commented 2 weeks ago

It's surprising that this issue still hasn't been resolved in 2024. All major browsers have supported TLS 1.3 since 2020 or earlier.