The fix, in one snippet
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
After the primary handshake, Scan.now attempts a small number of additional TLS handshakes, each offering only one family of legacy cipher suites: RC4, 3DES (DES-CBC3), export-grade (EXP-), NULL encryption, anonymous Diffie-Hellman (aNULL) and single DES. If the server completes any of these handshakes, the check fails and lists the accepted suites. It also inspects the suite chosen in the main TLS 1.2 handshake and notes whether it provides forward secrecy (an ECDHE or DHE key exchange) or uses static RSA key transport (TLS_RSA_*), and whether it is a CBC-mode suite with SHA-1 integrity. These are handshake offers only; no application data is sent. Scan.now does not run padding-oracle or Bleichenbacher probes (ROBOT, POODLE), which require crafted records; testssl.sh does that. Protocol versions are covered in tls-deprecated-versions.
Why it matters
Each legacy family has a concrete break. RC4 has statistical biases that recover plaintext from repeated encryptions, which is why RFC 7465 prohibits it. 3DES has a 64-bit block size, and the Sweet32 attack recovers data from long-lived connections once enough traffic has passed. Export suites use 512-bit keys that can be factored in hours (FREAK, Logjam). NULL and anonymous suites provide no encryption or no authentication at all. Static RSA key exchange has no forward secrecy: a private key obtained later decrypts every recorded session. Modern browsers will not choose these suites, so the practical risk is to legacy clients and to anyone whose traffic was recorded for later decryption. Rated medium because exploitation needs a network position plus a cooperative client, but the fix is a one-line change. The SSL and TLS guide explains how a cipher suite is composed.
How to fix it
Use the Mozilla "intermediate" cipher list, which keeps compatibility with everything since 2013 while excluding every weak family. nginx:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_dhparam /etc/nginx/dhparam.pem; # 2048-bit or largerApache:
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder offNode.js accepts the same list via the ciphers option of https.createServer. On Cloudflare, SSL/TLS > Edge Certificates > Cipher suites lets you pick the Modern or Compatible preset; both exclude the families above. TLS 1.3 suites are fixed by the protocol and cannot be misconfigured. Verify afterwards with testssl.sh example.com or the SSL checker.
Where this fits
Weak cipher suites accepted is check 9 of 12 that the website vulnerability scanner runs under transport security (https / tls), ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Strict-Transport-Security (HSTS) (medium), where the HTTPS response carries no Strict-Transport-Security header, or its max-age is too short to protect returning visitors. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Weak cipher suites accepted closes one route in. Immediately below it: TLS 1.3 support, where the server negotiates TLS 1.2 at best and does not offer TLS 1.3; HSTS preload eligibility, where the domain does not yet meet the requirements for the browser HSTS preload list; HTTP/2 support, where the server negotiates only HTTP/1.1 over TLS and does not advertise HTTP/2.
Found in the same scan
The website vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Exposed .env configuration file, where a .env configuration file is served from the web root, and Exposed .git repository, where the site's .git directory is reachable over HTTP. A single run of website vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Weak cipher suites accepted (medium severity)
Scanner check id: weak-ciphersThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
