This is part of why HTTP+HTTPS still has a place for non-commercial non-institutional just for fun/education websites. HTTP+HTTPS is also significantly less fragile than HTTPS-only over any years+ long timescales. Eventually even the tool keeping your CA TLS cert up to date itself will stop working or the root cert will expire, etc. HTTP+HTTPS means the site keeps being accessible. If the threat model allows it, it's better.
On a long enough time window even your version of TLS itself will expire. This came up the other day in a discussion of how much of the web is still accessible to a browser like Netscape Navigator 4. It can't speak TLS 1.3 at all on its own, no matter if you give it an up-to-date CA bundle or not. There's a lot of the web that has already moved to TLS 1.3 with intentionally no fallback to older versions, or only fallback to TLS 1.2. No security conscious user of TLS 1.3 will say "fallback to SSL 2.0 is just fine", they set the defaults, and those defaults impact even things that don't need the tightest security such as blogs and fun/education websites.
Comments
This is part of why HTTP+HTTPS still has a place for non-commercial non-institutional just for fun/education websites. HTTP+HTTPS is also significantly less fragile than HTTPS-only over any years+ long timescales. Eventually even the tool keeping your CA TLS cert up to date itself will stop working or the root cert will expire, etc. HTTP+HTTPS means the site keeps being accessible. If the threat model allows it, it's better.
On a long enough time window even your version of TLS itself will expire. This came up the other day in a discussion of how much of the web is still accessible to a browser like Netscape Navigator 4. It can't speak TLS 1.3 at all on its own, no matter if you give it an up-to-date CA bundle or not. There's a lot of the web that has already moved to TLS 1.3 with intentionally no fallback to older versions, or only fallback to TLS 1.2. No security conscious user of TLS 1.3 will say "fallback to SSL 2.0 is just fine", they set the defaults, and those defaults impact even things that don't need the tightest security such as blogs and fun/education websites.