4

I've had a few complaints from visitors to a site I manage that they are unable to connect to their website due to TLS settings of their browser. When checked the devices in question were set to run TLS 1.1.

  • Is it common for clients to not have TLS 1.2 or have it disabled in 2017?
  • Can a LAMP Webserver be configured to handle TLS 1.1, alongside offering the more secure 1.2?

I'm considering switching hosting provider which is more compatible.

1
  • 1
    Were these complaints from users with old Android versions?
    – user13695
    Commented Oct 11, 2017 at 19:28

2 Answers 2

2
Is it common for clients to not have TLS 1.2 or have it disabled in 2017?

For older versions of Internet Explorer (8,9,10 on Windows 7), yes according to this: https://help.salesforce.com/articleView?id=000220586&language=en_US&type=1

These older versions of IE are sadly still relatively common, so the hosting provider may be a little too aggressive in its policy.

Can a LAMP Webserver be patched to handle 1.1 TLS, alongside offering the more secure 1.2?

All things are possible if you have enough control. It sounds like you're using a shared environment rather than a dedicated server. In a shared environment you're generally not going to get the level of control you desire.

Before you switch to a dedicated environment, you need to understand it's a double edged sword. A managed hosting environment means the hosting provider manages everything, including security problems. A dedicated server normally means YOU have to do this.

2
  • I'm sensing the hosting company is lazily blocking rather than patching security problems to avoid risk. Will look to another provider with a longer EOL for TLS 1.1 Commented Oct 11, 2017 at 21:54
  • @oli2020 Possibly. It may not be laziness as much as it is trying to maximize profits, or simply being a low-cost provider. Not all providers want to provide a high level of service, and would rather provide a minimal amount of service to minimize costs. In any case, a different provider is likely your best bet here. Commented Oct 12, 2017 at 16:32
3

Is it common for clients to not have TLS 1.2 or have it disabled in 2017?

All modern TLS clients support TLS 1.2. It is not that common that a client supports TLS 1.1 but not TLS 1.2 because most major TLS stacks like OpenSSL (Unix, Android), SChannel (Windows) or NSS (Firefox, older Chrome) started to support TLS 1.1 and TLS 1.2 at about the same time. A reason for this is that TLS 1.1 was standardized 2006 and TLS 1.2 2008, i.e. shortly after and most TLS stacks did not start to support either of these protocols until 2012..2014 so they then implemented both at the same time.

It is still common that some clients support neither TLS 1.1 nor TLS 1.2 (older Android, older Windows) but supporting TLS 1.1 and not TLS 1.2 is uncommon.

On the server side most sites offer TLS 1.0, TLS 1.1 and TLS 1.2 while some sites with higher security requirements (like Paypal payment API) require at least TLS 1.2.

Can a LAMP Webserver be patched to handle 1.1 TLS, alongside offering the more secure 1.2?

If you have full control of the server (which usually requires root on the system) you should be able to enable TLS 1.0 and TLS 1.1 and also only TLS 1.1 alongside TLS 1.2. If you don't have full control and only share the same web server with other users you cannot do this.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .