0

I just tested a site and it looks like the certificate uses weak ciphers but the certificate is new.

Can this issue be related to the Certification Authority that provides the certificate?

Or this issue is related to the possibility of older browser usage?

As you can see in the attached picture the test also found TLS versions above 1.2.

Are these implementations related to the accessibility for older browser versions?

enter image description here

Improve this question
5
  • The cipher suites are determined by the server, not the CA.
    – schroeder ♦
    Feb 1, 2021 at 10:48
  • @schroeder so if i want to unable the usage of older version of TLS i must check the server settings?
    – Ion Stirba
    Feb 1, 2021 at 10:50
  • Do you run the server or are you asking as a client?
    – schroeder ♦
    Feb 1, 2021 at 10:56
  • We have contacts with the company that setup our server su the first one
    – Ion Stirba
    Feb 1, 2021 at 10:58
  • Then, yes, you need to configure the server to only allow the cipher suites you want.
    – schroeder ♦
    Feb 1, 2021 at 10:59

1 Answer 1

Reset to default
1

Can this issue be related to the Certification Authority that provides the certificate?

No, the Certificate Authority has nothing to do with the ciphers supported by the server. The server supports a cert of ciphers according to its capabilities and configuration.

Or this issue is related to the possibility of older browser usage?

Older browsers don't support newer ciphers. The question is, do you want to jeopardize the security of all your users just to support people who still run Internet Explorer 8, which has been End-of-Life since Mid-2018.

What to do now?

  • Remove Support for SSLv3, TLS 1.0 and TLS 1.1.
  • Configure TLS 1.2 to only support strong ciphers, which provide Forward Secrecy

SOGIS recommends only using the following ciphersuites (see Chapter 6.1):

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CCM
TLS_ECDHE_ECDSA_WITH_AES_128_CCM
Improve this answer
1
  • 1
    He has an RSA certificate, using ECDSA is not an option. Nobody uses CCM, though it is secure. ChaCha20-Poly1305 is actually useful and is preferred by smartphones that don't have AES or CLMUL hardware for AES-GCM. The short definition is should support in TLS1.2 only cipher suites that are available in TLS1.3.
    – Z.T.
    Feb 1, 2021 at 12:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .