2

I am in a progress of trying (again) to get maximum (or almost maximum) score on SSL Labs with my site.

I currently do not understand, why it does not give me full Cipher strength score.

Now, it looks like this:

SSL Labs Cipher Strength < 100%


SSL Labs - Cipher strength score is less than 100%, why? And how do I make it full?

OS: GNU/Linux Debian 9.4 with Apache 2.4.25.


At a closer look, I found the following, which might reveal, what is wrong:

cipher suites weak

3

The picture basically depicts two things:

  1. All ciphers listed in SSLCipherSuite in your Apache2 configuration, which are defined as RSA+*, in my case I had RSA+AESGCM256:RSA+AES256:RSA+AES defined, are designated as weak.

  2. Technically speaking, it does not like the 128-bit ones, I believe, for grading purposes.

So, for instance, you may define the following to be SSL Labs match while being PCI DSS, NIST, and HIPAA guidance compliant, which you may test on High-Tech Bridge:

we can be either totally specific and to disable any cipher older than TLSv1.2 with:

SSLProtocol -all +TLSv1.2

SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA

or being non-specific, which I no longer recommend:

SSLCipherSuite ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:DH+AES256:!aNULL:!MD5:!DSS:!eNULL:!ADH:!EXP:!LOW:!PSK:!SRP:!RC4

Afterwards, you should see the result as follows:

cipher suites strong

Which, at the moment of writing gives you SSL Labs - Cipher strength score equal to 100%:

ssl labs result

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.