The picture basically depicts two things:
All ciphers listed in
SSLCipherSuite in your Apache2 configuration, which are defined as
RSA+*, in my case I had
RSA+AESGCM256:RSA+AES256:RSA+AES defined, are designated as weak.
Technically speaking, it does not like the 128-bit ones, I believe, for grading purposes.
So, for instance, you may define the following to be SSL Labs match while being PCI DSS, NIST, and HIPAA guidance compliant, which you may test on High-Tech Bridge:
we can be either totally specific and to disable any cipher older than TLSv1.2 with:
SSLProtocol -all +TLSv1.2
or being non-specific, which I no longer recommend:
Afterwards, you should see the result as follows:
Which, at the moment of writing gives you SSL Labs - Cipher strength score equal to 100%: