If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is obsolete. Enable an ECDHE-based cipher suite", which makes me question if its legit..?


It means that the cryptography from the certificate is breakable - the ROBOT attack is a good write up on how. ECDHE uses elliptic-curve cryptography, which is faster, uses less data for the same level of security, and relies on newer mathematical techniques (although it's not necessarily a good thing...but as a quick aside ECs were needed for solving Fermat's last theorem and that only happened in 1994).

So yes, it's a legit warning. It's probably just popping up because the site hasn't used a ECDHE cipher. Which is far from ideal, but if everybody followed best practices I'd be out of a job.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.