Who still cannot connect after dropping TLS 1.0 and 1.1

After narrowing ssl_protocols to TLSv1.2 and 1.3, the logs fill with no shared cipher and unsupported protocol from a surprising range of sources.

Typical: Android WebViews from several years ago, the default SSLContext in Java 6 and 7, printer and IoT firmware, and some payment or logistics SDKs.

Do not add the old protocols back globally. Find out who is affected first:

grep -h 'TLSv1\|TLSv1.1' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head

For devices that genuinely cannot upgrade, give them a separate server block on their own hostname or port, so the risk stays contained.