I am trying to correct weak encryption in TLS, by doing a test in SSL Labs, it throws weak encryption in the following chpher suite:

Current Configuration:


Cipher Suite TLS 1.2 - Weak:

  • TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) WEAK
  • TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d) WEAK

OHS Version: Oracle-HTTP-Server-11g/ (Unix) mod_ssl/

Try to solve with:

SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!AES128:!SHA1:!SHA256:!SHA384





None of these settings worked for my SSL configuration in OHS.

Someone has eliminated those two issues in weak encryption?

2 Answers 2


The ciphers are considered weak by SSLLabs since they use RSA key exchange which provides no forward secrecy. To disable RSA key exchange in your ciphers add !kRSA. In general, just use the Mozilla SSL Configuration Generator to give you a secure setting.

  • 1
    To add to this, ciphers that support forward secrecy will contain "DHE" or "ECDHE". Nov 6, 2018 at 17:00
  • Try with : SSLCipherSuite HIGH:ECDHE:!MEDIUM:!LOW:!aNULL:!eNULL:!AES128:!SHA1:!kRSA //not working and delete remove the last parameter !kRSA and working configuration, now test with ssl Labs
    – Ventur
    Nov 6, 2018 at 17:30
  • current configuration: SSLCipherSuite HIGH:ECDHE:!MEDIUM:!LOW:!aNULL:!eNULL:!AES128:!SHA1 add ECDHE parameter
    – Ventur
    Nov 6, 2018 at 17:31
  • 1
    @Ventur: what do you exactly mean with "not working"? Failure to start, SSLLabs shows only errors, unable to connect with browser, unable to connect with a specific client or what? Also, adding ECDHE (your next try) does not remove the ciphers with RSA key exchange. Nov 6, 2018 at 17:42
  • @SteffenUllrich with not working is unable to conect with browser, not displayed web page if add !kRSA.
    – Ventur
    Nov 6, 2018 at 17:50

If those ciphers are not working while RSA is then you may have a wrong certificate. If the key usage of the certificate only allows encryption (needed for RSA based key establishment in the TLS_RSA_ ciphers) then it won't work for RSA based authentication, which requires the signature generation key usage (needed for RSA based authentication in the TLS_DHE_ and TLS_ECDHE ciphers).

You may have to re-apply for a certificate, preferably using a new key pair - you may not want to mix key usages in general, which is why the key usage is in the cert in the first place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .