1

This question already has an answer here:

A customer I'm currently working with has reported the following as 'weak' cipher suites in use on a site:

Accepted  TLSv1.0  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLSv1.1  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLSv1.2  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-GCM-SHA256

The reasoning being: 'The highlighted issues are SHA is no longer supported (use SHA256 or SHA384), 128 bit ciphers are no longer supported.'

Are these observations valid? I'm assuming they can have their own internal policies that make them valid, but do they sound reasonable? The site gets an A on the Qualys test.

|improve this question

marked as duplicate by Steffen Ullrich tls Apr 7 '16 at 17:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.