A customer I'm currently working with has reported the following as 'weak' cipher suites in use on a site:
Accepted TLSv1.0 256 bits ECDHE-RSA-AES256-SHA
Accepted TLSv1.1 256 bits ECDHE-RSA-AES256-SHA
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256
The reasoning being: 'The highlighted issues are SHA is no longer supported (use SHA256 or SHA384), 128 bit ciphers are no longer supported.'
Are these observations valid? I'm assuming they can have their own internal policies that make them valid, but do they sound reasonable? The site gets an A on the Qualys test.
