Should we disable TLS 1.0 and 1.1?

Yes. Both have been formally deprecated by the IETF since RFC 8996 (March 2021), major browsers no longer accept them, and they rely on old hash functions and cipher constructions with known weaknesses. If they are still enabled on a server, the risk is less a direct attack than a downgrade path, and a sign of neglect that auditors, insurers and scanners will flag. Before switching them off, find out who still uses them: old printers, scanners, industrial devices, legacy applications and embedded clients are the usual suspects, and turning the protocols off without checking can stop a production line or a payment terminal. Look at server logs where they record the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. version, run an external scanner against public services, and inside the network look at the TLS versions in the handshakes. Then disable them, or isolate what cannot be upgraded in its own segment with a plan to replace it. The same inventory will serve your post-quantum work later.

← All 40 questions on Encryption and encrypted trafficAll topics