tls.version.tls11

TLS 1.1 Supported

What we check

We negotiate TLS with each MX IP and record which protocol versions the server supports. This finding is emitted when the server accepts TLS 1.1 connections.

What this finding means

The mail server still supports TLS 1.1, a protocol version formally deprecated by RFC 8996 (2021). TLS 1.1 shares many of TLS 1.0's structural limitations — it predates AEAD cipher suites and is no longer considered adequate.

Why it matters

• Deprecated standard. RFC 8996 prohibits both TLS 1.0 and TLS 1.1. The same compliance frameworks (PCI DSS, NIST, BSI) apply.
• No modern ciphers. TLS 1.1 cannot negotiate AEAD ciphers (AES-GCM, ChaCha20-Poly1305), which are the baseline for modern encryption.
• Downgrade target. An attacker who can downgrade a connection from TLS 1.2/1.3 to TLS 1.1 gains access to weaker cipher suites.

How to fix

1. Disable TLS 1.1 (and 1.0). For Postfix (3.6+ syntax):

   # /etc/postfix/main.cf
   smtpd_tls_protocols = >=TLSv1.2
   smtpd_tls_mandatory_protocols = >=TLSv1.2
   

2. Reload and verify:

   postfix reload
   openssl s_client -starttls smtp -connect mail.example.com:25 \
       -tls1_1 2>/dev/null | head -1
   # Expected: connection refused or handshake failure
   

How it's graded

Supporting TLS 1.1 carries a 10-point deduction in the TLS category. See Grading Methodology for the full scoring model.

Evidence example

Negotiated protocol: TLSv1.1
Server accepts deprecated TLS 1.1 connections

References

• RFC 8996 — Deprecating TLS 1.0 and TLS 1.1