# V5313\. OWASP\. Do not use old versions of SSL/TLS protocols as it may cause security issues\.

The analyzer has detected that the application uses legacy versions of the SSL/TLS protocol\. This can expose the application to attacks such as man\-in\-the\-middle, BEAST, etc\.

Issues related to the use of outdated protocols can fall into two [OWASP Top 10 2021](https://owasp.org/Top10/) categories:

* [A2: Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
* [A7: Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)

Look at the following example:

```cpp
private void createSocket() {
    SSLContext sslContext;
    try {
        sslContext = SSLContext.getInstance("TLSv1");    // <=
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
    }

    try {
        sslContext.init(null, null, new SecureRandom());
        var socketFactory = sslContext.getSocketFactory();
        var socket = (SSLSocket) socketFactory.createSocket();

        // ....

        socket.close();
    } catch (KeyManagementException | IOException e) {
        throw new RuntimeException(e);
    }
}
```

The code above contains the `TLSv1` value that represents the 1\.0 version of the TLS protocol\. This version is outdated and not recommended because TLS 1\.0 is vulnerable to a number of attacks, including the aforementioned BEAST\.

Experts recommend using newer protocol versions, such as TLS 1\.2:

```cpp
private void createSocket() {
    SSLContext sslContext;
    try {
        sslContext = SSLContext.getInstance("TLSv1.2");
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
    }

    try {
        sslContext.init(null, null, new SecureRandom());
        var socketFactory = sslContext.getSocketFactory();
        var socket = (SSLSocket) socketFactory.createSocket();

        // ....

        socket.close();
    } catch (KeyManagementException | IOException e) {
        throw new RuntimeException(e);
    }
}
```

Protocol versions below TLS 1\.2 are not recommended as they may cause security issues\. These protocols include SSL 2\.0 and 3\.0, as well as TLS 1\.0 and 1\.1\.

Usually, `TLS` is the most appropriate value, which allows the platform to choose the data transfer protocol\. If for some reason the value does not fit, set the latest version available\.

## Additional links:

* [Transport Layer Security \(TLS\) Protocol Overview](https://docs.oracle.com/en/java/javase/21/security/transport-layer-security-tls-protocol-overview.html)
* [Testing for Weak SSL TLS Ciphers Insufficient Transport Layer Protection](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_SSL_TLS_Ciphers_Insufficient_Transport_Layer_Protection)
* [Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html)
* [Man\-in\-the\-middle attack description](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack)
* [Man\-in\-the\-Browser attack description](https://owasp.org/www-community/attacks/Man-in-the-browser_attack)