Medium to high risk HTTPS · SSL/TLS encryption settings
Weak SSL/TLS settings: what they mean and how to fix them
Short answer: SSL/TLS is the encryption behind the padlock in the browser. Your server still accepts old versions or weak settings that attackers know how to break, or it has a known flaw like Heartbleed. Visitors may see a padlock, but the protection behind it is weaker than it looks.
The fix: update the server software, allow only TLS 1.2 and 1.3 with modern ciphers, and re-test. The free Mozilla SSL Configuration Generator writes the settings for you.
What your finding means
The Basic Scan runs Nmap's TLS checks on any encrypted port it finds: websites on 443, and also mail servers, VPN portals and admin panels. Find your finding below:
| Finding | What it means | Urgency |
|---|---|---|
| Heartbleed (CVE-2014-0160) | An old OpenSSL bug that lets anyone read chunks of server memory, including passwords and the site's private key. | Urgent |
| ChangeCipherSpec injection (CVE-2014-0224) | An old OpenSSL bug that lets an attacker in the middle weaken the encryption. | Urgent |
| DROWN (CVE-2016-0800) | SSLv2 is still enabled somewhere using your certificate, which can expose modern TLS traffic. | Urgent |
| POODLE (CVE-2014-3566) | SSLv3 is still enabled. It's broken and obsolete. | Soon |
| Weak Diffie-Hellman / Logjam (CVE-2015-4000) | The key exchange uses keys that are too small (under 2048 bits) or widely shared. | Soon |
| TLS 1.0 / 1.1, RC4, 3DES or export ciphers | Outdated versions and ciphers that modern browsers have dropped. | Soon |
The three urgent ones all come from outdated server software. Updating OpenSSL and the web server fixes them, and the rest are fixed by settings.
The report rates any check Nmap confirms as "VULNERABLE" as High. The urgency column is our advice on how quickly to act: the bugs that leak data or keys first, then the outdated settings.
- 443 TLS ChangeCipherSpec injection (CVE-2014-0224) Nmap's check reports: vulnerable High
- 993 Weak Diffie-Hellman key exchange Nmap's check reports: Diffie-Hellman Key Exchange Insufficient Group Strength (mail server, IMAP) High
Check your full TLS setup
- Websites: run the free Qualys SSL Labs test. It grades your setup A+ to F and lists exactly which protocols and ciphers are on.
- Any port (mail, VPN, admin panels):
Nmap grades each cipher. Anything below "A", and any line sayingnmap --script ssl-enum-ciphers -p 443,465,587,993,995 your-serverTLSv1.0orSSLv3, needs attention. The free testssl.sh tool gives an even more detailed report.
How to fix it
1. Update the server software
Install your operating system's updates, especially OpenSSL and the web server. On Ubuntu and Debian: sudo apt update && sudo apt upgrade, then restart the web server. This alone fixes Heartbleed, CCS injection and many cipher problems. If the system is too old to get updates, that's the real issue. See our guide to outdated server software.
After fixing Heartbleed, also replace the site's certificate and private key, and reset passwords, because they may have been read from memory before the fix.
2. Allow only TLS 1.2 and 1.3 with modern ciphers
The easiest way is the free Mozilla SSL Configuration Generator. Choose your server, choose "Intermediate", which works with every browser from the last several years, and copy the settings. The key lines look like this:
Apache (in the SSL virtual host or ssl.conf):
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLHonorCipherOrder off
SSLSessionTickets offnginx (in the server block or http block):
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;Add the generator's cipher list, then reload the server (sudo systemctl reload apache2 or nginx).
Windows Server / IIS / Exchange: TLS settings are system-wide in the Windows registry. The free IIS Crypto tool shows them as checkboxes. Apply its Best Practices template, untick TLS 1.0 and 1.1, and reboot. Test old internal apps afterwards, because some older software only speaks TLS 1.0.
3. Fix weak key exchange
Modern configurations use elliptic-curve key exchange (ECDHE), which avoids the Diffie-Hellman problem entirely. The Mozilla settings above handle this. If you must keep classic DH, use a 2048-bit or larger group, such as the ffdhe2048 file the generator links to.
4. Don't forget other services
Mail servers (ports 465, 587, 993, 995), VPN portals, printers and admin pages each have their own TLS settings. Firewalls, load balancers and hosting control panels often have a "TLS version" or "SSL profile" setting of their own. Fix them the same way: update, then allow only TLS 1.2 and 1.3.
5. Re-test
Run SSL Labs again (aim for A or A+, and add HSTS for the plus), then re-scan with FreshScanSentry.
Common questions
Will turning off TLS 1.0 and 1.1 lock anyone out?
Not modern visitors. Every current browser supports TLS 1.2 and 1.3, and the old versions were formally retired in 2021 (RFC 8996). Very old devices, such as Windows 7-era software, old Android phones or legacy scanners and payment terminals, may fail. Check anything internal that talks to the server.
We use Cloudflare or another CDN. Are we covered?
For visitors, mostly: the CDN handles their encryption, and you can set its minimum TLS version in its dashboard (choose 1.2). But your own server still matters if it can be reached directly, and the connection from the CDN to your server should also use modern TLS.
Is this the same as an expired certificate?
No. This guide is about encryption settings. An expired or invalid certificate causes a browser warning and is fixed by renewing it. Free automatic certificates are available from Let's Encrypt.
Sources: RFC 8996 (deprecating TLS 1.0 and 1.1) · Mozilla SSL Configuration Generator · NVD: Heartbleed · NVD: POODLE · NVD: DROWN · NVD: Logjam · Nmap ssl-enum-ciphers · Qualys SSL Labs