Summary
Acunetix 360 detected that insecure transportation security protocol (TLS 1.0) is supported by your web server.
TLS 1.0 has several flaws. An attacker can cause connection failures and they can trigger the use of TLS 1.0 to exploit vulnerabilities like BEAST (Browser Exploit Against SSL/TLS).
Websites using TLS 1.0 are considered non-compliant by PCI since 30 June 2018.
Impact
Attackers can perform man-in-the-middle attacks and observe the encryption traffic between your website and its visitors.
Actions To Take
We recommended to disable TLS 1.0 and replace it with TLS 1.2 or higher. See Remedy section for more details.
Remediation
Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
- For Apache, adjust the SSLProtocol directive provided by the mod_ssl module. This directive can be set either at the server level or in a virtual host configuration.
SSLProtocol +TLSv1.2
- For Nginx, locate any use of the directive ssl_protocols in the
nginx.conffile and removeTLSv1.ssl_protocols TLSv1.2;
- For Microsoft IIS, you should make some changes on the system registry. Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.
- Click on Start and then Run, type
regedt32orregedit, and then click OK. - In Registry Editor, locate the following registry key or create if it does not exist:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0
- Locate a key named
Serveror create if it doesn't exist. - Under the
Serverkey, locate a DWORD value namedEnabledor create if it doesn't exist and set its value to "0". - For lighttpd, put the following lines in your configuration file:
ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable" ssl.openssl.ssl-conf-cmd = ("Protocol" => "-TLSv1.1, -TLSv1, -SSLv3") # v1.4.48 or up ssl.ec-curve = "secp384r1"