I am in a progress of trying (again) to get maximum (or almost maximum) score on SSL Labs with my site.

I currently do not understand, why it does not give me full Cipher strength score.

Now, it looks like this:

SSL Labs Cipher Strength < 100%

SSL Labs - Cipher strength score is less than 100%, why? And how do I make it full?

OS: GNU/Linux Debian 9.4 with Apache 2.4.25.

At a closer look, I found the following, which might reveal, what is wrong:

cipher suites weak


The picture basically depicts two things:

  1. All ciphers listed in SSLCipherSuite in your Apache2 configuration, which are defined as RSA+*, in my case I had RSA+AESGCM256:RSA+AES256:RSA+AES defined, are designated as weak.

  2. Technically speaking, it does not like the 128-bit ones, I believe, for grading purposes.

So, for instance, you may define the following to be SSL Labs match while being PCI DSS, NIST, and HIPAA guidance compliant, which you may test on ImmuniWeb:

we can be either totally specific and to disable any cipher older than TLSv1.2 with:

## The protocols to enable:
## Available values: all, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
## SSLv2 and SSLv3 are no longer supported
# I prefer the latest TLSv1.3 and TLSv1.2 for compatibility reasons
# TLSv1 / TLSv1.1 are 20 / 13 years old, so decided to disable them
SSLProtocol    -all    +TLSv1.3 +TLSv1.2

## SSL Cipher Suites:
## List the ciphers that the client is permitted to negotiate. See the
## ciphers(1) man page from the openssl package for list of all available options.
# I can always run `openssl ciphers` to find all currently available ciphers
# As for TLSv1.3 the TLS_AES_128_GCM_SHA256 is mandatory as per RFC 8446:
# https://tools.ietf.org/html/rfc8446#section-9
# I use only AES ciphers as they get hugely accelerated by AES-NI
SSLCipherSuite    TLSv1.3    TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256

or being non-specific, which I no longer recommend:


Afterwards, you should see the result as follows, which, at the moment of writing my previous version of this post was:

cipher suites strong

Which, at the moment of writing my previous version of this post gave you SSL Labs - Cipher strength score equal to 100%:

ssl labs result

  • What about CHACHA? – qräbnö Jan 18 '20 at 20:12
  • 1
    @qräbnö I do not use ChaChaPoly cipher, as my server is AES CPU accelerated, and these ciphers are not, therefore I do not use them myself, feel free to do so, though. – LinuxSecurityFreak Jan 19 '20 at 10:31
  • Worth noting that CBC are now marked as weak. This doesn't affect grading yet, but it might soon. – mınxomaτ Jul 17 '20 at 0:14
  • Can you share the compatibility chart for your test? I'm looking for maximum compatibility (mostly older Safari versions) with the strongest ciphers. – Michael Yaeger Oct 2 '20 at 20:04
  • @MichaelYaeger Unfortunately, I no longer have the web server, so I can't. – LinuxSecurityFreak Oct 2 '20 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.