# TLS 1.0 connection attempt rejected: protocol version not supported

- **ID:** `security/tls-1-0-protocol-deprecated`
- **Domain:** security
- **Category:** network_error
- **Error Code:** `SSL_ERROR_PROTOCOL_VERSION_ALERT`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The server or client only supports TLS 1.0, which is deprecated and disabled by modern security policies, leading to handshake failure.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OpenSSL 1.1.1 | active | — | — |
| OpenSSL 3.0 | active | — | — |
| Nginx 1.18 | active | — | — |
| Java 11 | active | — | — |
| Java 17 | active | — | — |
| Python 3.8 | active | — | — |

## Workarounds

1. **Upgrade the client to support TLS 1.2 or higher. For OpenSSL: `openssl s_client -tls1_2 -connect host:port` to test.** (90% success)
   ```
   Upgrade the client to support TLS 1.2 or higher. For OpenSSL: `openssl s_client -tls1_2 -connect host:port` to test.
   ```
2. **If the client cannot be upgraded, configure the server to temporarily allow TLS 1.0 in a controlled environment, e.g., Nginx: `ssl_protocols TLSv1 TLSv1.1 TLSv1.2;` but use it only as a short-term mitigation.** (50% success)
   ```
   If the client cannot be upgraded, configure the server to temporarily allow TLS 1.0 in a controlled environment, e.g., Nginx: `ssl_protocols TLSv1 TLSv1.1 TLSv1.2;` but use it only as a short-term mitigation.
   ```
3. **For Java applications, set `-Djdk.tls.client.protocols=TLSv1.2` to force a newer protocol.** (85% success)
   ```
   For Java applications, set `-Djdk.tls.client.protocols=TLSv1.2` to force a newer protocol.
   ```

## Dead Ends

- **** — Disabling TLS 1.0 on the server without upgrading the client breaks compatibility for legacy clients. (80% fail)
- **** — Adding TLS 1.0 as a cipher suite doesn't work; cipher suites are separate from protocol versions. (90% fail)
- **** — Restarting the service without changing the TLS configuration doesn't resolve the version mismatch. (40% fail)