A printer keeps failing with a TLS error. Why would I let a site accept older TLS?

Some appliances support 802.1X but only offer an old version of TLS. Passbeam needs TLS 1.2, and a device that can't do it is refused before its certificate is checked. The authentication log says so: the device offered an older version of TLS than Passbeam accepts.

An example. An HP Color LaserJet M477fdn on a switch port, with a valid Passbeam certificate and the client's root CA installed, was refused every time. Its web page used TLS 1.2 without any trouble, but its 802.1X support is separate and older, and only went up to TLS 1.1. A firmware update from 2018 to 2020 didn't change it. Nothing was misconfigured. The two ends couldn't agree on a version.

Try a firmware update first. It costs nothing and doesn't weaken anything.

If there's no update, you can allow older TLS for one site. It's on that site's Transports tab, below the two transport cards. It lowers the minimum to TLS 1.0 for that site only. Nothing else changes: certificates are checked the same way, and a revoked or expired one is still refused. It's off at every site until you turn it on, and takes about a minute to apply either way.

What it costs. TLS 1.0 and 1.1 use SHA-1, so turning this on also allows cipher suites that are weak by today's standards, for that site only. That's why it's per site. One printer in a cupboard shouldn't change how every other site authenticates.

Knowing when to turn it off. Every authentication records the TLS version it used, so the Transports tab lists the devices that have needed older TLS in the last 30 days. A button next to the setting opens the authentication log filtered to those devices. If the list is empty you can probably turn it off, but a device that only connects every few months won't be on it.