On our server, we have TLS 1.0, 1.1 and 1.2 enabled. It hosts numerous client websites.
We were recently contacted by one such client flagging a concern that TLS 1.0 and TLS 1.1 is "still enabled". I don't know much about the subject matter, unfortunately. What I do know is, like me, they must've done a free security scan of their website which raises that fact as a "red flag" while conveniently ignoring that we have TLS 1.2 enabled also.
Despite the obvious compatibility issues that would arise from disabling those versions, what possible benefits are there to gain in disabling these legacy TLS versions on our server? Is it really such a vulnerability as they've been lead to believe?
I may be mistaken, but my understanding was that using TLS 1.0 and TLS 1.1 alone is the vulnerability. Upgrading to TLS 1.2 allows newer client browsers to avoid these vulnerabilities but am I mistaken?