One approach that's has a bunch of disadvantages, but is always usable without changing the services (it may be that the service not only accepts weak TLS cipher suites, but requires weak TLS suites, perhaps it's configured to not support anything newer than SSLv3) is SSL tunneling/proxying.
I.e. you configure the services (and the host ...
What options do I have for preventing network services from allowing weak TLS ciphers?
Changing the application or the applications configuration is one option, provided that the version of OpenSSL on the device actually supports the stronger ciphers you want.
Changing OpenSSL and restricting the available ciphers is another one, but make sure that all ...
It can't be changed globally in OpenSSL's configuration, but recompiling without certain ciphers is easy. Just give the no-[cipher-to-disable] parameter to ./configure.
./config no-ssl2 no-ssl3 no-tls1 no-tls1_1 no-dtls no-dtls1_1 no-ssl2-method no-ssl3-method no-tls1-method no-tls1_1-method no-dtls-method no-dtls1_1-method no-weak-ssl-ciphers