tls

What is checked: port 443 accepts only TLS 1.2 and/or 1.3, and the certificate is valid for the site's name and not expired (RFC 8996).

Why it matters: TLS 1.0 and 1.1 have known weaknesses and were formally deprecated in 2021; every current browser already refuses them. Keeping them on helps nobody and lets an attacker downgrade connections. An invalid certificate trains visitors to click through warnings.

Smallest fix: in the web server or load balancer, allow only TLS 1.2 and 1.3. For example, nginx: ssl_protocols TLSv1.2 TLSv1.3;, Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3. Use automatic certificate renewal (ACME / Let's Encrypt, or your provider's equivalent) so certificates don't expire.

The Mozilla SSL Configuration Generator gives tested settings for most servers.