tlsv1 alert protocol version

Common causes

• An old client offering only TLS 1.0 or 1.1 to a server that requires TLS 1.2 or newer.
• A client pinned to one version (for example --tlsv1.3 or a hard-coded SSLContext) that the server does not support.
• Seen in server logs: an outdated client or scanner tried an old TLS version and was refused.

How to fix it

1. Update the client OpenSSL, runtime or OS so it can negotiate TLS 1.2 or 1.3.
2. Remove hard-coded protocol versions from client code and config.
3. Check which TLS versions the server supports and keep TLS 1.2 and 1.3 enabled.