> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# TLS Version Auditor
> Probes which TLS protocol versions an HTTPS endpoint will complete a handshake with
**Security Auditor** — probes which TLS protocol versions an HTTPS endpoint will complete a handshake with.
TLS 1.0 and 1.1 are rejected; TLS 1.3 is the expected modern protocol.
TLS 1.2 without 1.3 is still accepted, but should be upgraded.
This auditor opens a TLS handshake to the audited host for each protocol Java can name (`TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`) and records which versions complete. Certificate validity is not judged here; a trust-all handshake is used so protocol support can still be measured on expired or self-signed sites.
## How it works
The auditor probes the HTTPS origin of the audited URL:
1. **Parse** — requires an `https` URL with a hostname. Non-HTTPS URLs skip the handshake and warn.
2. **Probe** — for each protocol, connects to `{host}:{port}` (default 443), sends SNI when the host is not a literal IP, and attempts a handshake with only that protocol enabled.
3. **Rules** — TLS 1.0 and TLS 1.1 are separate FAILs. Completing neither TLS 1.2 nor TLS 1.3 is a FAIL. TLS 1.2 without TLS 1.3 is a WARNING (skipped when no modern TLS is present).
4. **Aggregate** — `ERROR` (unreachable host or invalid URL) wins, then `FAIL`, then `WARNING`; if every rule passes, the audit is `SUCCESS`.
Java reports TLS 1.0 as `TLSv1`. Messages use the human labels TLS 1.0–1.3 and include the observed support map.
## What it audits
Every row maps to one `checkRule*` method and one `CheckCode`. CheckCode suffixes use status ranges: `200` success, `300–399` warning, `400–499` fail, `500–599` error.
| CheckCode | Status | When it fires | Recommendation |
| --------------------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- |
| `37A-TlsVersionAuditor-301` | `WARNING` | The URL scheme is not `https`. | Use https\:// for `{url}`; TLS versions cannot be audited over `{scheme}`. |
| `37A-TlsVersionAuditor-500` | `ERROR` | The host could not be reached, the URL is invalid, or every probe failed with a connectivity error. | Verify `{host}:{port}` is reachable over TLS; last error was `{error}`. |
| `37A-TlsVersionAuditor-400` | `FAIL` | A handshake completed using TLS 1.0 (`TLSv1`). | Disable TLS 1.0 on `{host}:{port}`; observed support `{protocolSupport}`. |
| `37A-TlsVersionAuditor-401` | `FAIL` | A handshake completed using TLS 1.1. | Disable TLS 1.1 on `{host}:{port}`; observed support `{protocolSupport}`. |
| `37A-TlsVersionAuditor-402` | `FAIL` | The scan finished but neither TLS 1.2 nor TLS 1.3 completed a handshake. | Enable TLS 1.2 or TLS 1.3 on `{host}:{port}`; observed support `{protocolSupport}`. |
| `37A-TlsVersionAuditor-300` | `WARNING` | TLS 1.2 completed a handshake and TLS 1.3 did not (skipped when `402` applies). | Enable TLS 1.3 on `{host}:{port}`; currently `{protocolSupport}`. |
| `37A-TlsVersionAuditor-200` | `SUCCESS` | TLS 1.3 is offered and TLS 1.0/1.1 are not; message is `{host}:{port} offers TLS 1.3 and does not offer TLS 1.0 or 1.1; observed support {protocolSupport}.` | — |
## Output documentation
| Status | Description | Test logic |
| ----------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SUCCESS** | The endpoint offers TLS 1.3 and does not offer TLS 1.0 or 1.1 | `TLSv1.3=true`, `TLSv1=false`, `TLSv1.1=false`. TLS 1.2 may still be offered. |
| **WARNING** | TLS cannot be probed, or only TLS 1.2 is modern | Scheme is not https (`301`); TLS 1.2 yes and TLS 1.3 no (`300`). |
| **FAIL** | Insecure protocols are enabled, or no modern TLS is offered | TLS 1.0 handshake (`400`); TLS 1.1 handshake (`401`); neither 1.2 nor 1.3 (`402`). A host can emit both insecure FAILs and the TLS 1.3-missing warning. |
| **ERROR** | The auditor could not measure protocol support | Invalid or empty URL; unknown host; connection refused or timed out (`500`). |
## Risks and considerations
### Deprecated protocols
* TLS 1.0 and TLS 1.1 are deprecated (RFC 8996). Browsers and PCI environments reject them; leaving them enabled expands the attack surface (BEAST, POODLE-class downgrade).
* A server that still completes TLS 1.0 fails even when it also offers TLS 1.2 or 1.3.
### Modern TLS
* TLS 1.3 (RFC 8446) removes legacy handshake modes and weak ciphers. TLS 1.2-only endpoints work for most clients today but should enable 1.3.
* An endpoint that speaks neither 1.2 nor 1.3 cannot be used safely by current browsers.
### Probe limits
* The Java runtime may disable TLS 1.0/1.1 (`jdk.tls.disabledAlgorithms`). If the client cannot enable a protocol, that version is recorded as not offered rather than as a server FAIL.
* This auditor does not validate certificates, cipher suites, or HSTS. Use the Certificate auditor for trust and expiry.
* Handshake probes use a trust-all manager so protocol support is visible even when the certificate would otherwise abort the connection.