TLS 1.0, 1.1, 1.2, 1.3: what is still open?
HTTPS is not a switch but a negotiation: server and browser together choose a TLS version and one cipher from what both parties offer. A server that still allows TLS 1.0 "works" for every modern browser — and stands open for every client that falls back to that version. The difference between policy and coincidence only shows when you interrogate the connection itself.
RFC 8996 deprecated TLS 1.0 and 1.1; PCI DSS and the browser houses have buried them in practice. But "buried" is a decision of the client, not of your server: if your server still serves the older version, it serves it. Measuring is done with the SSL test: every version probed separately, and per accepted version every candidate cipher probed separately.
This article explains the four versions, what the cipher choice hangs on, and what the ssltest takes from the handshake besides: OCSP stapling, the SCTs, certificate choice per name, session resumption and the chain the server delivers.
What the four versions mean today
TLS 1.3 left the old handshake and the weak cipher families behind; TLS 1.2, properly set, is still solid; TLS 1.1 and 1.0 are standards-deprecated and have little defence left. That "1.2 is fine" is no advice from this site — it is what the standardisation (RFC 8996) and the measurable outcome show: at 1.2 everything hangs on the cipher you allow, at 1.3 the choice is narrow and good.
The cipher is the actual door
Version permission is the facade; the cipher determines what can happen inside: which suites, which hashes, which key sizes. A server on 1.2 with CBC ciphers without encrypt-then-MAC, or with 3DES in the list, is something other than a server on 1.2 with only modern suites. That is why the ssltest probes every candidate cipher separately per version — the matrix that rolls out is no sample, it is every probe.
More than versions: what the ssltest measures besides
OCSP stapling (does the server send the revocation status moment along), the SCTs (Certificate Transparency log times embedded in the certificate), the certificate choice per SNI name, session resumption and the chain the server delivers — all handshake measurements standing apart from the version question. The grade the ssltest gives is the weighted average of these measured categories; a probe that was not measured counts nowhere, and a handshake rejected by the trust chain caps at D. The "Grade components" card shows the measurement per category.
To practice
Set your policy: 1.2 and 1.3 on, everything older off (where your client base allows it — an API for older clients is another decision than a website). Measure the public address with the ssltest and the certificate itself with the Certificate check. Does your mail server belong to this answer too? STARTTLS on mail ports is the same question on port 25 and 587. And for the header side of the same story: security headers.