From early 2020, browsers will refuse connections that use TLS 1.0 or 1.1. Servers on current software already offer TLS 1.2 and need at most a settings change; old servers need real work. No new certificate is involved.

What the browser makers announced

Yesterday Apple, Google, Microsoft and Mozilla each announced that their browsers will stop accepting two old versions of TLS, the encryption behind every https address, in early 2020.

Safari and Firefox are due to drop them in March 2020, Chrome early that year, and Edge and Internet Explorer 11 in the first half of 2020.

The versions being retired are TLS 1.0, from 1999, and TLS 1.1, from 2006. Almost every connection browsers make today already uses something newer.

Nothing changes this week. The long notice is for sites still relying on the old versions, most of them on servers nobody has looked at in years.

What TLS does, briefly

When a visitor opens an https page, the browser and your server first agree how to encrypt the conversation. TLS, short for Transport Layer Security, is the set of rules for that agreement.

The browser lists the versions it can use, and the server picks the newest one they share. A server that only knows TLS 1.0 pulls the conversation back to 1999, weaknesses and all.

TLS 1.2, from 2008, carries most connections now. TLS 1.3, finalised in August, is faster and simpler again.

Who this actually affects

The second is the one most often missed. The main site moves to better hosting over the years, while the portal on a subdomain stays where it was installed, tied to something else.

Why a current host makes this quick

Any server running supported software from the last few years already offers TLS 1.2, so its visitors will notice nothing in 2020.

Switching the two old versions off on such a server is a line or two of configuration. Many hosts have done it already, and others will over the coming months.

The real work is on old servers. If the operating system cannot offer TLS 1.2 at all, no setting will add it; the server needs upgrading, or the site needs moving.

How to check what your server offers

A browser shows only the version it used. In Chrome, the Security tab in the developer tools names it for the page you are on, such as TLS 1.2.

To see every version a server will accept, use a free online server test, which tries each version in turn and lists the ones that succeed.

Run it on every address the business uses, not only the main site: the shop, the booking page, the client portal, the webmail login.

Or ask your host to confirm in writing. A good host can answer that in one line.

Reading the result

The report lists each protocol version with a yes or a no. SSL 2 and SSL 3, the predecessors of TLS, should say no; TLS 1.2 must say yes, and a yes for TLS 1.3 is a bonus.

A yes for 1.0 and 1.1 is no emergency while 1.2 is there too. It is simply the setting to switch off before 2020.

A server that says yes to 1.0 and no to 1.2 is exactly what this announcement is about.

A worked example

An industrial fastener distributor sells bolts, anchors and specialty fasteners to contractors and manufacturers. Trade customers order through a portal on a subdomain, tied to its stock system.

The main website moved to current hosting two years ago. The portal stayed on an older server elsewhere, because moving it meant touching the stock system, and nobody wanted to.

After the announcement, its web company ran a server test on both addresses. The main site offered TLS 1.2 and 1.3. The portal offered TLS 1.0 and nothing newer.

Its operating system was old enough that no setting could add TLS 1.2. In early 2020, every customer's browser would have refused to open it.

The portal moves to a current server in January, the distributor's quietest month, with ordering tested from start to finish first.

The shipping desk's computer, still running Internet Explorer on Windows XP, which cannot use TLS 1.2, is being replaced the same week.

Nothing about the certificate changes

Expect emails offering certificate upgrades on the back of this news. The certificate is not the issue.

A certificate proves the site's identity and works with any version of TLS. A new certificate installed on an old server leaves the server exactly as old.

This week does bring one genuine certificate question. Chrome 70, released today, stops trusting certificates from one older family of certificate authorities, and that is a separate check from this one.

Switching the old versions off

A server that offers 1.2 can keep accepting 1.0 and 1.1 until 2020 without troubling current browsers. Switching them off sooner is still worth doing.

Card payment industry rules already required systems handling card data to stop using SSL and TLS 1.0 by the end of June this year.

The cost is a few very old visitors, such as Internet Explorer on Windows XP and some Android phones from before about 2013. The browser reports in Analytics show whether any still visit.

Many payment gateways have already dropped the old versions too, so a site on an old server can find its checkout failing while every page still loads.

The counter-case

For most small business sites, this announcement changes nothing.

A site on maintained hosting already offers TLS 1.2, and nobody needs a new certificate, a new host or an urgent rebuild because of it.

A site due to move or be rebuilt in the next year can fold the check into that work, provided it happens well before 2020.

But every address the business uses deserves one test this autumn, because the address that fails is rarely the main site.

This month

  1. List every address the business uses online.
  2. Run a server test on each one.
  3. Confirm TLS 1.2 is offered everywhere.
  4. Check Analytics for very old browsers.
  5. Ask your host to switch off 1.0 and 1.1.
  6. Plan a move for any server without 1.2.
  7. Ignore certificate upgrade offers tied to this.

Step one is where the real risk turns up. The main site is usually fine; the portal, the booking page or the webmail login on a separate machine is where TLS 1.0 lingers.

The certificate change arriving in Chrome this week is covered in certificates Chrome will stop trusting in October.

Frequently asked questions

What did the browser makers announce?

Apple, Google, Microsoft and Mozilla said their browsers will stop accepting TLS 1.0 and 1.1 in early 2020. Safari and Firefox name March; Edge and Internet Explorer the first half.

Will my website stop working in 2020?

Only if its server cannot offer TLS 1.2. Servers on supported software from the last few years already do, so their visitors will notice nothing when the browsers change.

Do I need a new certificate?

No. The certificate proves the site's identity and works with any TLS version. The version is set by the server's software and settings, which is where any fix happens.

How do I check what my server supports?

Run a free online server test on each address the business uses. It tries every protocol version and lists which ones succeed. Your host can also confirm in writing.

Should TLS 1.0 and 1.1 be switched off now?

Usually, yes, once 1.2 is confirmed. Check Analytics for visitors on very old browsers first, since Internet Explorer on Windows XP and some old phones cannot connect without them.

Which addresses are most likely to fail?

Subdomains on separate machines: ordering portals, booking pages and webmail logins installed years ago. The main site has usually moved to better hosting; these often stayed behind.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Portal or booking page on an old server?

Send us every address your business uses. We will test each one and tell you which needs work before 2020.

Start a Conversation