en
/login
Koval SEO

The server does not offer TLS 1.3

In the reportTLS 1.3 upgrade available — origin tops out at TLS 1.2

tls_1_3_not_supported · Opportunity

Short answer

This appears when ordinary connections to your server use TLS 1.2 and a test connection that offers only TLS 1.3 is refused as an unsupported version. TLS 1.3 is the current version of the protocol. Enable it alongside TLS 1.2 when your server or CDN supports it.

Severity: Notice.

Why it matters

RFC 8446 specifies TLS 1.3, the current version of the protocol that protects connections to your site. A server limited to TLS 1.2 is still supported; this is an upgrade that is available, not a fault.

What to do

  1. Look at the finding: it shows the version negotiated on the ordinary handshakes and the refusal of the TLS 1.3 handshake.
  2. Enable TLS 1.3 in your CDN or hosting panel, or in the server configuration, for example by adding TLSv1.3 to ssl_protocols in nginx. Keep TLS 1.2 enabled.
  3. If the option is missing, your server software or TLS library may need an update first.

When to leave it as it is: if your hosting does not offer TLS 1.3 yet, you can leave it. TLS 1.2 is not deprecated.

What we read

We resolve your site's HTTPS address once and make a small, fixed number of TLS handshakes to that one server address, six at most for all TLS checks together. No page is requested over them. An ordinary, certificate-verified handshake is made before and after, and both must succeed and agree.

It is reported when both ordinary handshakes negotiate TLS 1.2 and a handshake that offers only TLS 1.3 is refused with the protocol_version alert. It passes when the TLS 1.3 handshake is negotiated, or when both ordinary handshakes already use TLS 1.3.

Example & evidence

Illustrative example — one audit, not a live result.

An audit makes its test handshakes to the server of bakery.example:

ordinary handshake      TLS 1.2 negotiated, certificate verified
offer TLS 1.3 only      refused: alert protocol_version
ordinary handshake      TLS 1.2 negotiated, certificate verified

The server tops out at TLS 1.2, so the site is reported as an opportunity. A possible correction: TLS 1.3 is enabled; the test handshake is then negotiated, and nothing is reported.

Confirm & check again

Check for yourself: open your site in a current browser, open the security details of the connection in its developer tools and read the protocol version.

Check again: Full audit — run a new audit of the site. The finding closes when the TLS 1.3 handshake to your server is negotiated, or both ordinary handshakes use TLS 1.3. A failed or unclear handshake leaves it unconfirmed.

Limits & sources

A timeout, a reset connection and any refusal other than the protocol_version alert are left unconfirmed. If the audit's own TLS library cannot offer TLS 1.3, the check is recorded as not checked.

The check does not measure connection speed and makes no claim about how much faster your site would load.

One server address is tested at one time from one location. A site served from several addresses, or through a CDN that answers differently elsewhere, can behave differently there.

Confidence: High because the finding rests on the server's own refusal of the version, between two ordinary verified handshakes that negotiated TLS 1.2.

Sources

Editorial review: 15 October 2026