macOS and iOS Mail.app Do Not Support TLSv1.2
Over the last couple of days I had to deal with this issue several times. Apple’s iOS 9 (used by older, still working iPads, for example) and macOS versions before Sierra (10.12) do not support TLSv1.2 or even TLSv1.1 in Mail.app at all. This is just regarding Mail.app. Safari and most third-party apps work just fine with TLSv1.2, thanks to Apple’s own iOS 9 requirement that apps communicating with a back end need to use TLSv1.2-encrypted communication:
If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible. In addition, your communication through higher-level APIs needs to be encrypted using TLS version 1.2 with forward secrecy. If you try to make a connection that doesn’t follow this requirement, an error is thrown. If your app needs to make a request to an insecure domain, you have to specify this domain in your app’s Info.plist file.
Well, Mail.app is the quintessential client app using a back end server: the mail server. You notice the irony here, right?
So if you want to follow security best practices and have older iOS or macOS clients (with their own set of unpatched security issues of course), all you can do is lowering your mail server encryption back to TLSv1 (no longer considered secure) and require all users to connect via VPN to check their mail. Nice.
While I certainly understand Apple’s need to move things forward, not everyone has the cash needed to upgrade to a newer iPad/iPhone every 2-4 years, nor should there be a need to. If a device is working properly, albeit slow, abandoning security updates for it is an act of gross negligence, not only from a user security standpoint but especially regarding natural resources — a topic Apple purports to care tremendously about. The best policy here would be to both allow devices to be used as long as possible and to open them up to third party software once back-porting security updates is no longer financially feasible. There are more than enough FreeBSD and Linux enthusiasts willing to support alternative software on those devices — if only they could. However, this could potentially hurt sales of new devices. If a tablet does what it is supposed to, why buy a new one? Just switch the battery at some time and you’re good for another couple of years.
Once an iOS device is deemed too old to be supported, you stand to lose important functionality at a moment’s notice. There is no upgrade path, no way to install alternative operating systems. You can only update by shelling out several hundred bucks. This kind of a computing future is not a sustainable one.