We have a significant portion of sales still coming in from users using browsers that do not yet support TLS 1.1+. We also have demands from our payment processors to stop supporting TLS 1.0 for PCI compliance.
My question is this:
Is it considered PCI compliant if your server still supports TLS 1.0 but you don't allow users using it to purchase and submit personal or credit card info.
The flow would go like this:
User visits website and tries to purchase product
Apache server would look at SSL_PROTOCOL and check to ensure the user isn't using TLSv1
If user is using TLSv1, we would inform the user in a friendly way that they need to upgrade their browser to complete their purchase, or call us at our office to help them complete the purchase.
If a user is using TLSv1.1+, we would let them go about their business.
The idea here is that if we just remove TLS 1.0 users using browsers that only support that will get a browser error page and not a nice page informing them of the problem from our website.
My question boils down to: Does PCI compliance require the server itself not support TLS 1.0, or does it only require you've mitigated the ability for personal data to be transmitted via TLS 1.0
Thanks for the advice, SO'ers.