TLS Cipher Suite Weakness Detected: Quick Fix Guide

Quick Answer for the Impatient

Disable all ciphers that use RC4, 3DES, or MD5. On Windows Server, run this command in an elevated PowerShell: Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_RC4_128_SHA', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA'. Then restart your web server.

Why You're Seeing This Warning

You or your security scanner found a weakness in your server's TLS configuration. This usually shows up as a warning like TLS cipher suite weakness detected or a similar note from Nessus, Qualys SSL Labs, or your company's vulnerability scanner.

Here's the short version: your server is offering old, broken encryption methods. Hackers can break these in hours or minutes. The two big offenders are:

• RC4 – completely broken. Microsoft, Google, and Apple all stopped using it years ago.
• 3DES – slow and vulnerable to Sweet32 attack. You should never use it.
• Any cipher using MD5 – just no.

This tripped me up the first time too. I had a Windows Server 2012 R2 box that passed PCI scans for two years, then suddenly failed on a new TLS check. The fix was simple: remove a few weak ciphers from the registry.

How to Fix It (Step by Step)

For Windows Server (IIS, Exchange, SQL, etc.)

1. Open PowerShell as Administrator.
2. Run this command to see all enabled ciphers:
   

   Get-TlsCipherSuite | Where-Object {$_.Name -like '*RC4*' -or $_.Name -like '*3DES*' -or $_.Name -like '*MD5*'}

3. Disable each weak cipher. For example:
   

   Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_RC4_128_SHA'
   Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_RC4_128_MD5'
   Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

4. Reboot the server or at least restart IIS with iisreset.

Note: On older Windows (Server 2008 R2, 2012), you can't use PowerShell. Instead, go to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers and manually disable RC4 and 3DES by setting their Enabled DWORD to 0.

For Apache

1. Open your SSL config file – usually /etc/httpd/conf.d/ssl.conf or /etc/apache2/mods-enabled/ssl.conf.
2. Find the line that starts with SSLCipherSuite. Replace it with this:
   

   SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

3. Save the file and restart Apache: sudo systemctl restart apache2 or sudo service httpd restart.

For Nginx

1. Open your nginx config – usually /etc/nginx/nginx.conf or a site file.
2. Inside the server block that handles HTTPS, add or change this line:
   

   ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

3. Test the config: sudo nginx -t.
4. Reload: sudo systemctl reload nginx.

What If the Warning Persists?

Sometimes the fix doesn't take right away. Here's what to check:

• Did you restart the server? Not just the web service. TLS cipher changes on Windows often need a full reboot.
• Are you behind a load balancer or reverse proxy? If you use AWS ALB, Cloudflare, or HAProxy, you need to configure ciphers there too. The server behind might be fine, but the front-end is still offering weak ciphers.
• Is your scanner targeting the right host? I once spent 3 hours fixing an old Apache box, only to realize the scanner was pointing at the load balancer, not the server.
• Check for TLS 1.0/1.1. Some scanners report cipher weakness when the real problem is old protocol versions. Disable TLS 1.0 and 1.1. Keep TLS 1.2 and 1.3.

How to Stop This From Happening Again

Set up a monthly scan with SSL Labs' SSL Server Test (free) or use a tool like testssl.sh. Run it after every OS patch or web server update. A lot of updates re-enable old ciphers – I've seen Windows Update do this twice.

Also, use a configuration management tool like Ansible or a simple PowerShell script that runs weekly and disables any weak ciphers that appear. Here's a basic one-liner for Windows:

Get-TlsCipherSuite | Where-Object {$_.Name -like '*RC4*' -or $_.Name -like '*3DES*' -or $_.Name -like '*MD5*'} | Disable-TlsCipherSuite

One last thing: don't blindly copy cipher lists from the internet. Some lists exclude all DHE ciphers, which breaks compatibility with old Android phones and some POS systems. The list I gave above works with everything modern and passes PCI scans.