SSL_ERROR_PROTOCOL_VERSION_ALERT security network_error ai_generated true

TLS 1.0 connection attempt rejected: protocol version not supported

ID: security/tls-1-0-protocol-deprecated

Also available as: JSON · Markdown · 中文
90%Fix Rate
88%Confidence
1Evidence
2024-01-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
OpenSSL 1.1.1 active — — —
OpenSSL 3.0 active — — —
Nginx 1.18 active — — —
Java 11 active — — —
Java 17 active — — —
Python 3.8 active — — —

Root Cause

The server or client only supports TLS 1.0, which is deprecated and disabled by modern security policies, leading to handshake failure.

generic

中文

服务器或客户端仅支持 TLS 1.0，而现代安全策略已弃用并禁用它，导致握手失败。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc8996

Workarounds

  1. 90% success Upgrade the client to support TLS 1.2 or higher. For OpenSSL: `openssl s_client -tls1_2 -connect host:port` to test. 
    Upgrade the client to support TLS 1.2 or higher. For OpenSSL: `openssl s_client -tls1_2 -connect host:port` to test.
  2. 50% success If the client cannot be upgraded, configure the server to temporarily allow TLS 1.0 in a controlled environment, e.g., Nginx: `ssl_protocols TLSv1 TLSv1.1 TLSv1.2;` but use it only as a short-term mitigation. 
    If the client cannot be upgraded, configure the server to temporarily allow TLS 1.0 in a controlled environment, e.g., Nginx: `ssl_protocols TLSv1 TLSv1.1 TLSv1.2;` but use it only as a short-term mitigation.
  3. 85% success For Java applications, set `-Djdk.tls.client.protocols=TLSv1.2` to force a newer protocol. 
    For Java applications, set `-Djdk.tls.client.protocols=TLSv1.2` to force a newer protocol.

中文步骤

  1. 升级客户端以支持 TLS 1.2 或更高版本。对于 OpenSSL：使用 `openssl s_client -tls1_2 -connect host:port` 进行测试。
  2. 如果无法升级客户端，可在受控环境中临时允许 TLS 1.0，例如 Nginx 配置：`ssl_protocols TLSv1 TLSv1.1 TLSv1.2;` 但仅作为短期缓解措施。
  3. 对于 Java 应用，设置 `-Djdk.tls.client.protocols=TLSv1.2` 以强制使用更新的协议。

Dead Ends

Common approaches that don't work:

  1. 80% fail

    Disabling TLS 1.0 on the server without upgrading the client breaks compatibility for legacy clients.

  2. 90% fail

    Adding TLS 1.0 as a cipher suite doesn't work; cipher suites are separate from protocol versions.

  3. 40% fail

    Restarting the service without changing the TLS configuration doesn't resolve the version mismatch.