PCI DSS 4.0 TLS Requirements: What You Must Know About SSL/TLS Compliance
PCI DSS 4.0 became mandatory on March 31, 2025. One of the most technically significant changes is the hard requirement for TLS 1.2 or higher on all systems that transmit or process cardholder data. This is no longer a "best practice" — using TLS 1.0 or TLS 1.1 is now a direct compliance failure under Requirement 6.4.1. Here's what the standard requires and exactly how to verify and achieve compliance.
Vulnerability Checker
Run a PCI scan for weak protocols, deprecated ciphers, and vulnerabilities.
Try It Free →What PCI DSS 4.0 Actually Requires
Per the official PCI Security Standards Council documentation, Requirement 4.2.1 mandates "strong cryptography" for cardholder data transmitted over open, public networks, and Requirement 6.4.1 (formerly 4.1 under PCI DSS 3.2.1) explicitly disallows TLS versions below 1.2. Requirement 8.3.2 additionally applies strong cryptography requirements to remote administrative access. The Council's own guidance defines TLS 1.0 and TLS 1.1 as no longer meeting the "strong cryptography" bar due to known protocol weaknesses (BEAST, POODLE-adjacent downgrade risks, and weak cipher suite support).
| Requirement | What It Covers | Compliant | Non-Compliant |
|---|---|---|---|
| 4.2.1 | Cardholder data in transit over public networks | TLS 1.2, TLS 1.3 | TLS 1.0, TLS 1.1, SSLv3 |
| 6.4.1 | Public-facing web applications | Strong cipher suites, no export-grade ciphers | RC4, DES, 3DES, NULL ciphers |
| 8.3.2 | Remote administrative access | TLS 1.2+ with mutual auth where applicable | Legacy VPN/remote protocols without modern TLS |
How to Verify Your Server's TLS Configuration
Server Configuration to Meet Requirement 6.4.1
Cipher Suites: What "Strong" Means Under PCI DSS
Beyond protocol version, Requirement 6.4.1 also implicitly disqualifies weak cipher suites even over TLS 1.2. ASV scans specifically flag:
- RC4 — cryptographically broken stream cipher, disallowed regardless of TLS version.
- 3DES / DES — vulnerable to the SWEET32 birthday attack on 64-bit block ciphers.
- Export-grade ciphers — deliberately weakened ciphers from 1990s export regulations, still occasionally offered by misconfigured legacy servers.
- NULL ciphers — no encryption at all; should never be enabled but occasionally appear in default configs.
Do You Still Need an ASV Scan If You Pass This Check Yourself?
Yes. Self-verification with the tools above is a good pre-check, but PCI DSS still requires quarterly external vulnerability scans by a PCI SSC-approved Approved Scanning Vendor (ASV) for most merchant levels, plus annual internal/external penetration testing. Fixing TLS/cipher issues before your ASV scan avoids a failed scan cycle and the remediation-and-rescan delay that comes with it.
Check your TLS configuration for PCI compliance
Verify which TLS versions and cipher suites your server accepts, and catch non-compliant configurations before an audit.