Browser Warns "Site Uses Outdated Security" – Real Fixes

1. Your Server Still Uses TLS 1.0 or 1.1

This is by far the most common reason you see the "site uses outdated security settings" warning. If you're running a website on a server that hasn't had its TLS stack updated in a few years, your browser (Chrome, Firefox, Edge) will block the connection with this message.

What's happening: Back in 2018 and 2020, all major browsers killed support for TLS 1.0 and TLS 1.1. These old versions have known security holes. Your site is still trying to use them, so the browser screams "outdated security."

Here's how to fix it. These steps assume you have admin access to your web server.

For Apache or Nginx (Linux servers)

1. SSH into your server.
2. Open the SSL configuration file. For Apache, it's usually /etc/apache2/sites-available/default-ssl.conf. For Nginx, it's /etc/nginx/nginx.conf or a site-specific file under /etc/nginx/sites-enabled/.
3. Find the line that says SSLProtocol or ssl_protocols. Right now it probably says something like SSLProtocol all -TLSv1 -TLSv1.1 or ssl_protocols TLSv1 TLSv1.1 TLSv1.2.
4. Change it to only allow TLS 1.2 and TLS 1.3. Use this: SSLProtocol TLSv1.2 TLSv1.3 for Apache, or ssl_protocols TLSv1.2 TLSv1.3; for Nginx.
5. Save the file and restart your web server. For Apache: sudo systemctl restart apache2. For Nginx: sudo systemctl restart nginx.
6. After you restart, open a browser and visit your site again. The warning should be gone. If you still see it, move to the next fix.

For IIS (Windows Server)

1. Open IIS Manager. Press Windows + R, type inetmgr, hit Enter.
2. Select your server name in the left panel.
3. Double-click "SSL Settings" in the middle pane.
4. Check the box "Require SSL" if it's not already. Under "Client certificates," select "Ignore" unless you need client certs.
5. Now you need to edit the registry to disable old TLS versions. Press Windows + R, type regedit, hit Enter.
6. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
7. Right-click "Protocols" and create a new Key called TLS 1.0. Inside that, create two more keys: Client and Server. In both, create a DWORD (32-bit) named Enabled and set its value to 0. Do the same for TLS 1.1.
8. Make sure TLS 1.2 and TLS 1.3 have Enabled set to 1 (or just create the keys if they don't exist).
9. Reboot the server. After reboot, test the site.

2. Your SSL Certificate Chain Is Incomplete

Sometimes the server's TLS version is fine (1.2 or 1.3), but the browser still shows the warning. The next culprit is a missing intermediate certificate. This happens a lot when someone copies the main certificate but forgets the intermediate files.

What it looks like: Visitors see the warning. You check the certificate details in your browser (click the padlock in the address bar), and it says "Certificate is not trusted" or "Missing intermediate." The error code might be SEC_ERROR_UNKNOWN_ISSUER in Firefox.

How to fix the certificate chain

1. Buying a certificate? Great. Your provider (Let's Encrypt, DigiCert, GoDaddy, etc.) will give you more than one file. You get your certificate file (like yourdomain.crt) and a certificate authority bundle (like ca-bundle.crt or intermediate.crt).
2. Combine them into one file. Open your terminal or command prompt.
3. If you have a bundle file, just append it to your certificate: cat yourdomain.crt ca-bundle.crt > combined.crt.
4. Upload combined.crt to your server. Replace the old yourdomain.crt file.
5. For Apache, update the SSLCertificateFile line to point to combined.crt. Also set SSLCertificateChainFile to the ca-bundle.crt (some newer Apache versions ignore this and just use the combined file).
6. For Nginx, update ssl_certificate to point to combined.crt. Make sure ssl_trusted_certificate points to the same combined file.
7. Restart the web server.
8. After restart, test with a browser. The warning should be gone. If you still see it, check the certificate chain at SSL Labs – it's a free tool. It shows you exactly which intermediate is missing.

3. Your Server Uses Deprecated Cipher Suites

Even if you have TLS 1.2 enabled and a proper certificate chain, you can still get the warning. This happens when your server only offers old, weak cipher suites. Chrome and Edge have been blocking weak ciphers since 2022.

What you'll see: The same warning. But checking the certificate shows it's valid. The TLS version is fine. The problem is the encryption method — the cipher suite — is too old.

How to check and fix cipher suites

1. Go to SSL Labs and test your site. Look at the "Cipher Suites" section. If you see suites like TLS_RSA_WITH_AES_128_CBC_SHA or TLS_DHE_RSA_WITH_AES_128_CBC_SHA (those are weak), you need to remove them.
2. For Nginx, open your config file. Add or edit the ssl_ciphers line. Use this safe list: ssl_ciphers HIGH:!aNULL:!eNULL:!MD5:!DES:!RC4:!3DES:!CBC;. This gives you only strong ciphers.
3. For Apache, edit the same SSL config file. Add or edit: SSLCipherSuite HIGH:!aNULL:!eNULL:!MD5:!DES:!RC4:!3DES:!CBC.
4. For IIS, you can't easily edit cipher suites in the GUI. Use the free tool IIS Crypto. Download it, run it on the server. Select the "Best Practices" template. It disables weak ciphers and enables only strong ones. Then reboot.
5. After changes, test again at SSL Labs. You should see only strong ciphers like TLS_AES_256_GCM_SHA384 and TLS_CHACHA20_POLY1305_SHA256. The browser warning should be gone.

Quick-Reference Summary Table