Comment by nodefortytwo

I am in the same industry and we have the same problem. We are moving to having "insecure" proxies that support TLS 1.1 for devices that can't update. It won't add much security but at least demonstrates its was an active decsion to support it rather than a config mistake.