Challenge 3: The Real Trade-Off in Restricting to TLS 1.3 Only —
Solution Walkthrough

The real trade-off:

Restricting SSLProtocol to TLS 1.3 only maximizes security posture for
whichever clients can actually connect, but it isn't a setting with no
downside. Per this chapter's own warning box, a small population of
genuinely old clients -- outdated Android versions, old embedded
devices, some corporate environments stuck on legacy software -- may
not support TLS 1.3, or in some cases even TLS 1.2. Applying "TLS 1.3
only" uniformly across every site the company runs risks locking out
real visitors on some of those sites, not just closing off attackers.

The question that should actually be asked first:

Not "what's the most secure setting?" in the abstract, but "who
actually needs to be able to reach each specific site?" A site aimed
at a general public audience, some of whom may still be on older
devices or browsers, may need to tolerate TLS 1.2 as well. An internal
admin tool or API consumed only by the company's own modern,
controlled infrastructure is exactly the kind of case where TLS 1.3
only is genuinely the right call with no real downside. The decision
should be made per site based on its actual audience, not applied
reflexively everywhere just because it's the most restrictive option
available.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader treats "more restrictive" and
"more correct" as genuinely different things -- the right setting
depends on who the site actually serves, echoing this chapter's own
point that maximizing one property (security) can have a real,
named cost (compatibility) that deserves a deliberate decision rather
than an automatic default.