A printer keeps failing with a TLS error. Why would I let a site accept older TLS?

Because some appliances advertise 802.1X and then offer a version of TLS from before it was required. Passbeam needs TLS 1.2, and a device that cannot reach it is refused before its certificate is ever looked at. The authentication log names this specifically — the device offered an older version of TLS than Passbeam accepts — so you do not have to work it out from a handshake error.

A real example, and the one this feature came from. An HP Color LaserJet M477fdn on a switch port, with a valid Passbeam certificate installed and the client's root CA in place, was refused every time. Its own web interface served TLS 1.2 with a modern cipher perfectly well — but Jetdirect runs the 802.1X supplicant on a separate, older code path, and that path offered at most TLS 1.1. Updating the firmware from 2018 to 2020 did not change it. The printer was not misconfigured and neither was the network; the two ends simply could not agree a version.

**Try firmware first.** A device that fails this often has a supplicant older than the rest of it, and a vendor update costs nothing and weakens nothing. Check for one before reaching for the switch below.

If there is no update, you can allow older TLS for **one site** — on that site's Transports tab, below the two transport cards. It lowers the floor to TLS 1.0 for handshakes from that site and nothing else changes: the ceiling stays where it is, certificates are checked exactly as before, and a revoked or expired one is still refused. It is off at every site until somebody turns it on, and it takes about a minute to take effect either way.

What it costs, plainly. TLS 1.0 and 1.1 sign their handshakes with SHA-1, so allowing them also re-admits cipher suites that are weak by current standards — for that site's traffic, and no other. This is why it is per site rather than a setting for your whole account: one printer in a cupboard should not change how anybody else's network authenticates.

How to get back off it without guessing. Every authentication records the TLS version it actually negotiated, so the site's Transports tab lists which devices have needed the exception in the last 30 days, and a button beside the switch opens the authentication log filtered to exactly those. If the list is empty, nothing has used it recently and you can probably switch it off — bearing in mind that something which only connects every few months would not appear there.