Weak TLS Cipher Suites: How to Fix and Harden Your HTTPS
Weak TLS cipher suites like RC4 and 3DES leave your HTTPS connections vulnerable. Learn how to identify weak ciphers and configure strong ones on Nginx and Apache.
What are cipher suites?
A cipher suite is a set of cryptographic algorithms that your web server and a visitor's browser agree to use when establishing an HTTPS connection. The cipher suite determines how the connection is encrypted, how keys are exchanged, and how data integrity is verified.
When your server supports outdated or weak cipher suites, attackers can potentially downgrade the connection and decrypt traffic. This is not theoretical -- tools like BEAST and Sweet32 have demonstrated practical exploits against weak ciphers.
Which cipher suites are weak?
The following are considered deprecated or insecure:
| Protocol / Cipher | Status | Risk |
|---|---|---|
| TLS 1.0 | Deprecated since 2020 | BEAST, POODLE attacks |
| TLS 1.1 | Deprecated since 2020 | No known safe cipher suites |
| RC4 | Broken | Plaintext recovery attacks |
| 3DES | Deprecated | Sweet32 birthday attack |
| DES | Broken | Brute force in hours |
| Export ciphers | Broken | FREAK, Logjam attacks |
| NULL ciphers | No encryption | Traffic sent in plaintext |
| SHA-1 based ciphers | Deprecated | Collision attacks proven feasible |
You should only support TLS 1.2 and TLS 1.3. Both PCI DSS and major browser vendors have dropped support for TLS 1.0 and 1.1.
How to check your current cipher suites
Using SSL Labs (easiest)
Visit SSL Labs Server Test and enter your domain. It gives you a letter grade and lists every cipher suite your server supports, colour-coded by strength.
Using openssl (from terminal)
# Check if TLS 1.0 is still enabled (you want this to FAIL)
openssl s_client -connect yourdomain.com:443 -tls1 </dev/null 2>&1 | grep "Protocol"
# Check if TLS 1.1 is still enabled (you want this to FAIL)
openssl s_client -connect yourdomain.com:443 -tls1_1 </dev/null 2>&1 | grep "Protocol"
# List all supported ciphers for TLS 1.2
openssl s_client -connect yourdomain.com:443 -tls1_2 -cipher 'ALL' </dev/null 2>&1 | grep "Cipher"
If the TLS 1.0 or 1.1 commands succeed, your server still supports deprecated protocols.
Using nmap
nmap --script ssl-enum-ciphers -p 443 yourdomain.com
This lists all supported cipher suites grouped by protocol version, with a strength rating for each one.
Using testssl.sh
testssl.sh is an open-source tool that gives you even more detail than SSL Labs:
git clone --depth 1 https://github.com/drwetter/testssl.sh.git
cd testssl.sh
./testssl.sh yourdomain.com
How to fix on Nginx
Edit your Nginx server block (usually in /etc/nginx/sites-enabled/ or /etc/nginx/conf.d/):
# Modern TLS configuration (Mozilla recommended)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
# Enable session resumption for performance
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
# HSTS (optional but recommended -- 2 year max-age)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
Then test and reload:
sudo nginx -t
sudo systemctl reload nginx
How to fix on Apache
Edit your Apache SSL configuration (usually /etc/apache2/sites-enabled/default-ssl.conf or your vhost file):
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
# HSTS (optional but recommended)
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Then test and reload:
sudo apachectl configtest
sudo systemctl reload apache2
Mozilla SSL Configuration Generator
Mozilla maintains an excellent SSL Configuration Generator that produces copy-paste configs for Nginx, Apache, HAProxy, AWS ALB, and more. Select the "Modern" profile for the strongest settings, or "Intermediate" if you need to support older clients.
Verify the fix
After making changes, run SSL Labs again or use openssl:
# This should now FAIL (good -- TLS 1.0 is disabled)
openssl s_client -connect yourdomain.com:443 -tls1 </dev/null 2>&1
# This should succeed (TLS 1.2 works)
openssl s_client -connect yourdomain.com:443 -tls1_2 </dev/null 2>&1
Your SSL Labs grade should be A or A+ after fixing weak ciphers and enabling HSTS.
For more on TLS certificate health and expiry monitoring, see our guide on expired TLS certificates. If you are also reviewing your network exposure, check our article on dangerous open ports.
How SurfaceScan helps
SurfaceScan checks TLS configuration on every HTTPS-enabled host during each scan. It detects weak cipher suites, deprecated protocols (TLS 1.0/1.1), and missing security features like HSTS. Findings appear in the TLS Certificates section with the specific cipher or protocol that needs attention, so you know exactly what to fix and where.
Related articles
Open Ports: Which Ones Are Dangerous and How to Close Them
Not all open ports are a problem, but some should never be exposed to the internet. Learn which ports are dangerous, why, and how to close them safely.
TLS Certificate Expired: How to Fix and Prevent
An expired TLS certificate causes browser security warnings. Learn how to renew it quickly with Let's Encrypt or commercial CAs, and prevent it from happening again.