I am in a progress of trying (again) to get maximum (or almost maximum) score on SSL Labs with my site.

I currently do not understand, why it does not give me full Cipher strength score.

Now, it looks like this:

SSL Labs Cipher Strength < 100%

SSL Labs - Cipher strength score is less than 100%, why? And how do I make it full?

OS: GNU/Linux Debian 9.4 with Apache 2.4.25.

At a closer look, I found the following, which might reveal, what is wrong:

cipher suites weak

2 Answers 2


The picture basically depicts two things:

  1. All ciphers listed in SSLCipherSuite in your Apache2 configuration, which are defined as RSA+*, in my case I had RSA+AESGCM256:RSA+AES256:RSA+AES defined, are designated as weak.

  2. Technically speaking, it does not like the 128-bit ones, I believe, for grading purposes.

So, for instance, you may define the following to be SSL Labs match while being PCI DSS, NIST, and HIPAA guidance compliant, which you may test on ImmuniWeb:

we can be either totally specific and to disable any cipher older than TLSv1.2 with:

## The protocols to enable:
## Available values: all, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
## SSLv2 and SSLv3 are no longer supported
# I prefer the latest TLSv1.3 and TLSv1.2 for compatibility reasons
# TLSv1 / TLSv1.1 are 20 / 13 years old, so decided to disable them
SSLProtocol    -all    +TLSv1.3 +TLSv1.2

## SSL Cipher Suites:
## List the ciphers that the client is permitted to negotiate. See the
## ciphers(1) man page from the openssl package for list of all available options.
# I can always run `openssl ciphers` to find all currently available ciphers
# As for TLSv1.3 the TLS_AES_128_GCM_SHA256 is mandatory as per RFC 8446:
# https://tools.ietf.org/html/rfc8446#section-9
# I use only AES ciphers as they get hugely accelerated by AES-NI
SSLCipherSuite    TLSv1.3    TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256

or being non-specific, which I no longer recommend:


Afterwards, you should see the result as follows, which, at the moment of writing my previous version of this post was:

cipher suites strong

Which, at the moment of writing my previous version of this post gave you SSL Labs - Cipher strength score equal to 100%:

ssl labs result

  • What about CHACHA?
    – qräbnö
    Commented Jan 18, 2020 at 20:12
  • 1
    @qräbnö I do not use ChaChaPoly cipher, as my server is AES CPU accelerated, and these ciphers are not, therefore I do not use them myself, feel free to do so, though. Commented Jan 19, 2020 at 10:31
  • Worth noting that CBC are now marked as weak. This doesn't affect grading yet, but it might soon.
    – mınxomaτ
    Commented Jul 17, 2020 at 0:14
  • Can you share the compatibility chart for your test? I'm looking for maximum compatibility (mostly older Safari versions) with the strongest ciphers. Commented Oct 2, 2020 at 20:04
  • @MichaelYaeger Unfortunately, I no longer have the web server, so I can't. Commented Oct 2, 2020 at 23:09

This setting was passed 100%, but some device can't access to my website

  • @RohitGupta I don't think this was a question - I think it was legitimately an answer - ie how to get 100% on the test today - with the caveat that it limits functionality.
    – davidgo
    Commented May 12, 2023 at 10:56
  • @davidgo, I guess you can read it that way. Deleted my comment Commented May 12, 2023 at 12:37
  • Seeking 100 score is not always the correct goal. This post can be improved by providing examples of what does not work. Otherwise, users must do more research to understand the answer. Commented May 12, 2023 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.