PCI DSS 3.1 was released two weeks ago, on 14 April 2015. It lays out that
SSL and early TLS are not considered strong cryptography and cannot be
used as a security control after 30th June, 2016.
In December 2015, the date for migrating existing applications was pushed back two years:
The Payment Card Industry Security Standards Council (PCI SSC) is
extending the migration completion date to 30 June 2018 for
transitioning from SSL and TLS 1.0 to a secure version of TLS
(currently v1.1 or higher).
These dates provided by PCI SSC as of December 2015 supersede the
original dates issued in both PCI Data Security Standard v3.1 (DSS
3.1) and in the Migrating from SSL and early TLS Information Supplement in April 2015.
As I understand it, "new applications" must still be implemented in line with the new requirement of 1.1+; the extension only applies to existing applications that used TLS 1.0 prior to April 2015.
The definition of what "early TLS" means is the subject of fascinated debate among QSAs, but it's safe to say 1.0 is part of it (and 1.1? Could be! Wait and find out!). (Update - as of December 2015, 1.1 is still "safe")
Here's how TrustWave says they're implementing these guidelines:
- New implementations must use alternatives to SSL and early TLS.
- Organizations with existing implementations of SSL and early TLS must have a risk mitigation and migration plan in place.
- Prior to June 30, 2016, Approved Scanning Vendors (ASVs) may document receipt of an organizations risk mitigation and migration
plan as an exception in the ASV Scan Report (in accordance with the
ASV Program Guide).
- Point of Sale (POS) or Point of Interaction (POI) devices that can be verified as not being susceptible to all known exploits of SSL and
early TLS may continue to use these protocols as a security control
after June 30, 2016.
So, if it's a new application, you might have to remove TLS 1.0 support. If it's not, push back on TrustWave and find out what sort of a "risk mitigation and migration plan" they require.
(Pulling the link from @mti2935 up out of the comments, here is Trustwave's Risk Plan Template. Thanks @mti2935!)