ssl8 min readUpdated 2025-12-28
TLS: Ciphers, Versions and Common Mistakes
TLS 1.2 and TLS 1.3 are the only versions any site should still be speaking. Older versions have known vulnerabilities and are actively removed from browsers.
Recommended profile
Follow Mozilla's Intermediate profile unless you have a specific reason not to. It supports every browser released in the last decade and drops every broken cipher.
OCSP stapling
Enable it. Clients that would otherwise stall waiting for OCSP responses get them from your server in the handshake.
Frequently asked questions
- Not yet. TLS 1.2 with modern ciphers is still safe, and disabling it locks out clients that lack TLS 1.3 support.
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan