We have SSL on our site, however we have some legacy applications that do not support SSL, what to do in this case?
In order for them to work correctly will I have to leave HTTP and HTTPS active?
How does Google rank works in this case?
Unless you update these legacy apps, then you would seem to have no choice but to run both HTTP and HTTPS?
With regards to SEO, Google will tend to favor HTTPS over HTTP. You should ensure that the HTTPS version is set as the canonical in the
rel="canonical" link element.
we have some aplication that wouldn't be able to access our site over HTTPS
Is your site able to detect these applications when they connect? Perhaps by user-agent? If so, then you could redirect everyone else except these few applications to the canonical HTTPS URL.
HTTPS is a protocol that uses Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL). Older browsers dating back to Internet Explorer 7 can only use TLS v1.0 however this version is now considered insecure, so attempting to serve HTTPS to these browsers or apps would be extremely pointless.
You can find a huge list of browser HTTPS support per protocol type on Salesforce.
Your website or app should aim to use minimal of TLS v1.1+ and you should disable SSLv2 or SSLv3 as these are also considered insecure, SSLv1 was never released to the public. If it's considered insecure, its pointless using it.
SOURCE: Can I Use TLS 1.1