News
TLS 1.2 vs TLS 1.3 for Public Marketing Sites
March 5, 2026
TLS 1.2 vs TLS 1.3 for public marketing sites is which handshake the edge offers, not whether the URL is HTTPS. TLS 1.3 is the current generation: fewer round trips, no renegotiation theater, modern AEAD-only ciphers. TLS 1.2 remains for older clients until you have data they are gone. TLS 1.0 and 1.1 belong off. A working cert and HSTS still matter more for OPSEC than winning a cipher beauty contest. RoastMyOpsec's free TLS check confirms the audited URL lands on HTTPS and that the runtime trust store accepts the certificate. It does not enumerate cipher suites, does not test expiry calendars, and does not score missing TLS 1.3 as an F.
The practical difference
HTTPS as a scheme is 'use TLS.' The version is 'which TLS.' A site on TLS 1.2 only is still HTTPS. A site that still offers 1.0 is the miss. Mixed content and HSTS are orthogonal — see those guides.
CDN defaults often enable 1.2+1.3. Origin-only TLS behind the CDN can lag. Align both.
How to choose a policy
Start from Mozilla Intermediate or Modern SSL config on the edge. Drop 1.0/1.1. Keep 1.2 until analytics or support prove otherwise. Turn on 1.3. Do not disable 1.2 the week before a government-client RFP. Certificate expiry automation first — HSTS plus an expired leaf is a lockout.
| Generation | Typical role in 2026 | Roast today | Takeaway |
|---|---|---|---|
| TLS 1.3 | Prefer on public edges | Not scored as required | Enable it |
| TLS 1.2 | Compatibility | Not a finding by itself | Keep until clients move |
| TLS 1.0 / 1.1 | Legacy | Not a cipher scan | Turn off at the CDN |
| Valid cert + HTTPS URL | This visit works | Free TLS check | The roast actually tests this |
What the roast can prove
Scheme and trust-store acceptance on the submitted URL. Cipher lists, 1.3-only, and OCSP stapling are out of scope. Pair with certificate expiry vs HSTS and Alt-Svc if you also advertise HTTP/3.
Common mistakes
The first mistake is TLS 1.3-only on a site whose payment iframe still needs 1.2.
The second mistake is hardening origin ciphers while the CDN still offers 1.0.
The third mistake is treating a roast TLS pass as a Qualys A+.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is TLS 1.2 a vulnerability?
- Not by itself in 2026. TLS 1.0/1.1 are the versions to remove. Prefer offering 1.3 alongside 1.2.
- Does RoastMyOpsec grade cipher suites?
- No. It checks HTTPS and the runtime trust store. It does not scan ciphers or expiry calendars.
- Should brochure sites disable TLS 1.2?
- Only with evidence. Missing TLS 1.3 is not a roast F.